Function at 0x48cf60
Capabilities:
Check for time delay via gettickcount
Create thread
Get common file path
Query or enumerate registry value
Read .ini file
Read file on windows
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x607672
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0xfe0c
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
push 0x207
mov dword [ebp - 0xf7dc], edx
mov dword [ebp - 0xf6f0], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xf620], ecx
mov ecx, dword [ebp + 0x18]
or esi, 0xffffffff
lea edx, [ebp - 0x37b]
push ebx
xor edi, edi
push edx
mov dword [ebp - 0xf6e4], ebx
mov dword [ebp - 0xf7a0], ebx
mov dword [ebp - 0xf768], ebx
mov dword [ebp - 0xf670], esi
mov dword [ebp - 0xf630], esi
mov dword [ebp - 0xf610], esi
mov dword [ebp - 0xf6b4], ebx
mov dword [ebp - 0xf5f8], eax
mov dword [ebp - 0xf608], 1
mov dword [ebp - 0xf60c], edi
mov dword [ebp - 0xf704], ebx
mov dword [ebp - 0xf740], ebx
mov dword [ebp - 0xf730], ecx
mov byte [ebp - 0x37c], bl
call fcn.005dfd60
push 0x103
lea eax, [ebp - 0x14bf]
push ebx
push eax
mov dword [ebp - 0xf774], ebx
mov dword [ebp - 0xf69c], ebx
mov dword [ebp - 0xf6bc], ebx
mov dword [ebp - 0xf6f4], ebx
mov dword [ebp - 0xf648], ebx
mov dword [ebp - 0xf5f0], ebx
mov dword [ebp - 0xf644], ebx
mov byte [ebp - 0x14c0], bl
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x1dd3]
push ebx
push ecx
mov byte [ebp - 0x1dd4], bl
call fcn.005dfd60
push 0x103
lea edx, [ebp - 0x1ed7]
push ebx
push edx
mov byte [ebp - 0x1ed8], bl
call fcn.005dfd60
push 0xfff
lea eax, [ebp - 0x13bb]
push ebx
push eax
mov byte [ebp - 0x13bc], bl
call fcn.005dfd60
push 0x40f
lea ecx, [ebp - 0x72a3]
push ebx
push ecx
mov byte [ebp - 0x72a4], bl
call fcn.005dfd60
add esp, 0x48
push 0x7ff
lea edx, [ebp - 0x2beb]
push ebx
push edx
mov byte [ebp - 0x2bec], bl
call fcn.005dfd60
push 0x103
lea eax, [ebp - 0x16c7]
push ebx
push eax
mov byte [ebp - 0x16c8], bl
call fcn.005dfd60
mov byte [ebp - 0x174], bl
push 0x103
lea ecx, [ebp - 0x173]
push ebx
push ecx
call fcn.005dfd60
push 0x3ff
lea edx, [ebp - 0x1ccf]
push ebx
push edx
mov byte [ebp - 0x1cd0], bl
call fcn.005dfd60
push 0x218
lea eax, [ebp - 0xefac]
push ebx
push eax
mov dword [ebp - 0xf604], ebx
mov dword [ebp - 0xf6c4], esi
mov dword [ebp - 0xf6b0], esi
mov dword [ebp - 0xf694], ebx
mov dword [ebp - 0xf7c8], ebx
mov dword [ebp - 0xf718], ebx
mov dword [ebp - 0xf71c], ebx
mov dword [ebp - 0xf650], ebx
mov dword [ebp - 0xf68c], ebx
mov dword [ebp - 0xf62c], ebx
mov dword [ebp - 0xf800], ebx
mov dword [ebp - 0xf744], ebx
mov dword [ebp - 0xf80c], ebx
mov dword [ebp - 0xf624], ebx
mov dword [ebp - 0xf638], ebx
mov dword [ebp - 0xf678], ebx
mov dword [ebp - 0xf6dc], ebx
mov dword [ebp - 0xf688], ebx
mov dword [ebp - 0xf61c], ebx
mov dword [ebp - 0xf6d0], ebx
mov dword [ebp - 0xf634], ebx
mov dword [ebp - 0xf600], ebx
mov dword [ebp - 0xf664], ebx
mov dword [ebp - 0xf698], ebx
mov dword [ebp - 0xf654], ebx
mov dword [ebp - 0xf67c], ebx
mov dword [ebp - 0xf658], ebx
mov dword [ebp - 0xf810], ebx
mov dword [ebp - 0xf794], ebx
mov dword [ebp - 0xf738], ebx
mov dword [ebp - 0xf6b8], ebx
mov dword [ebp - 0xf618], ebx
mov dword [ebp - 0xf6cc], ebx
mov dword [ebp - 0xf6fc], ebx
mov dword [ebp - 0xf700], ebx
mov dword [ebp - 0xf6f8], ebx
mov dword [ebp - 0xf6e8], ebx
mov dword [ebp - 0xf64c], ebx
mov dword [ebp - 0xf684], ebx
mov dword [ebp - 0xf65c], ebx
mov dword [ebp - 0xf75c], ebx
mov dword [ebp - 0xf66c], ebx
mov dword [ebp - 0xf680], ebx
mov dword [ebp - 0xf640], ebx
mov dword [ebp - 0xf7d0], ebx
mov dword [ebp - 0xf728], ebx
mov dword [ebp - 0xf668], ebx
mov dword [ebp - 0xf724], ebx
mov dword [ebp - 0xf6a8], ebx
mov dword [ebp - 0xf6a4], ebx
mov dword [ebp - 0xf73c], ebx
mov dword [ebp - 0xf7ac], ebx
mov dword [ebp - 0xf7b0], ebx
mov dword [ebp - 0xf708], ebx
mov dword [ebp - 0xf5f4], ebx
mov dword [ebp - 0xf6e0], ebx
mov dword [ebp - 0xefb0], ebx
call fcn.005dfd60
push 0x13c
lea ecx, [ebp - 0xeb6c]
push ebx
push ecx
mov dword [ebp - 0xeb70], ebx
call fcn.005dfd60
add esp, 0x48
mov dword [ebp - 0xf798], ebx
mov dword [ebp - 0xf674], ebx
cmp dword [0x72bdfc], ebx
je 0x48d2de
lea edx, [ebp - 0xf7a0]
lea eax, [ebp - 0xf768]
mov dword [ebp - 0xf714], edx
mov dword [ebp - 0xf70c], eax
jmp 0x48d2ea
mov dword [ebp - 0xf714], ebx
mov dword [ebp - 0xf70c], ebx
mov eax, dword [0x6e91b0]
neg eax
sbb eax, eax
lea ecx, [ebp - 0xf794]
and eax, ecx
mov dword [ebp - 0xf6ac], eax
cmp dword [0x71de6c], ebx
jne 0x48d311
cmp dword [0x72be04], ebx
je 0x48d31d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xf740], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 8]
push 0x732b8c
mov dword [0x6e9080], eax
mov dword [ebp - 0xf614], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x733104]
cmp eax, ebx
je 0x48d370
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xf798], eax
cmp eax, ebx
jne 0x48d370
mov edx, dword [0x733104]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x733104]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi*4 + 0x6e9224], 1
mov dword [ebp - 0xf5fc], eax
jne 0x48d5f6
mov eax, dword [esi*4 + 0x71de80]
cmp eax, ebx
je 0x48d5f6
lea edx, [ebp - 0xf7e0]
push edx
push 0x1a
push eax
mov dword [ebp - 0xf7e0], ebx
mov dword [ebp - 0xf814], ebx
mov dword [ebp - 0xf834], ebx
mov dword [esi*4 + 0x6e9224], ebx
call dword [0x6e90e4]
mov ecx, dword [esi*4 + 0x71de80]
lea eax, [ebp - 0xf814]
push eax
push 0x1b
push ecx
call dword [0x6e90e4]
mov eax, dword [esi*4 + 0x71de80]
lea edx, [ebp - 0xf834]
push edx
push 0x57
push eax
call dword [0x6e90e4]
mov eax, dword [ebp - 0xf7e0]
add esp, 0x24
cmp eax, ebx
jne 0x48d52a
cmp dword [0x71de78], 1
jne 0x48d5f6
cmp dword [0x71de6c], ebx
je 0x48d45b
push 0x103
lea ecx, [ebp - 0x4633]
push ebx
push ecx
mov byte [ebp - 0x4634], bl
call fcn.005dfd60
push esi
lea edx, [ebp - 0x4634]
push str._ARCH___FX_a__SETTING_Archive_Scan_on_ScanInstance__d_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x4634]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
mov edx, dword [esi*4 + 0x71de80]
push 1
push 0x1a
push edx
call dword [0x6e90e0]
mov eax, dword [esi*4 + 0x71de80]
push 1
push 0x1b
push eax
call dword [0x6e90e0]
mov ecx, dword [esi*4 + 0x71de80]
push 1
push 0xff0
push ecx
call dword [0x6e90e0]
mov edx, dword [0x685bc0]
mov eax, dword [esi*4 + 0x71de80]
push edx
push 0x28
push eax
call dword [0x6e90e0]
mov ecx, dword [esi*4 + 0x71deac]
push 1
push 0x1a
push ecx
call dword [0x6e90e0]
mov edx, dword [esi*4 + 0x71deac]
push 1
push 0x1b
push edx
call dword [0x6e90e0]
mov eax, dword [esi*4 + 0x71deac]
add esp, 0x48
push 1
push 0xff0
push eax
call dword [0x6e90e0]
mov ecx, dword [0x685bc0]
mov edx, dword [esi*4 + 0x71deac]
push ecx
push 0x28
push edx
call dword [0x6e90e0]
mov eax, dword [esi*4 + 0x71de80]
push 1
push 0x57
push eax
call dword [0x6e90e0]
mov ecx, dword [esi*4 + 0x71deac]
push 1
push 0x57
push ecx
call dword [0x6e90e0]
add esp, 0x30
jmp 0x48d5f6
cmp eax, 1
jne 0x48d5f6
cmp dword [0x71de78], ebx
jne 0x48d5f6
cmp dword [0x71de6c], ebx
je 0x48d58d
push 0x103
lea edx, [ebp - 0x401b]
push ebx
push edx
mov byte [ebp - 0x401c], bl
call fcn.005dfd60
push esi
lea eax, [ebp - 0x401c]
push str._ARCH___FX_a__RESETTING_Archive_Scan_on_ScanInstance__d_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x401c]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
mov eax, dword [esi*4 + 0x71de80]
push ebx
push 0x1a
push eax
call dword [0x6e90e0]
mov ecx, dword [esi*4 + 0x71de80]
push ebx
push 0x1b
push ecx
call dword [0x6e90e0]
mov edx, dword [esi*4 + 0x71deac]
push ebx
push 0x1a
push edx
call dword [0x6e90e0]
mov eax, dword [esi*4 + 0x71deac]
push ebx
push 0x1b
push eax
call dword [0x6e90e0]
mov ecx, dword [esi*4 + 0x71de80]
push ebx
push 0x57
push ecx
call dword [0x6e90e0]
mov edx, dword [esi*4 + 0x71deac]
push ebx
push 0x57
push edx
call dword [0x6e90e0]
add esp, 0x48
mov eax, dword [ebp - 0xf5fc]
sub eax, dword [esi*4 + 0x6e91d4]
cmp eax, 0x5265c0
jbe 0x48d698
mov eax, dword [esi*4 + 0x71de80]
cmp eax, ebx
je 0x48d68b
push 1
push 0x42
push eax
call dword [0x6e90e0]
add esp, 0xc
cmp eax, ebx
jne 0x48d63b
cmp dword [0x71de6c], ebx
je 0x48d671
push esi
push str._optFreeModuleInstances_Done_For_ThreadIndex:__d
jmp 0x48d649
cmp dword [0x71de6c], ebx
je 0x48d671
push esi
push str._optFreeModuleInstances_Failed_For_ThreadIndex:__d
lea ecx, [ebp - 0x13bc]
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push ebx
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
call fcn.004f4f50
push eax
push str.LastNow
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov ecx, dword [ebp - 0xf5fc]
mov dword [esi*4 + 0x6e91d4], ecx
mov eax, dword [ebp - 0xf7dc]
cmp eax, ebx
je 0x48d6aa
mov edx, dword [eax]
mov dword [ebp - 0xf5f4], edx
mov eax, dword [ebp - 0xf6f0]
cmp eax, ebx
je 0x48d6bc
mov edi, eax
mov dword [ebp - 0xf60c], eax
mov ecx, dword [0x71de6c]
cmp ecx, ebx
je 0x48d7e1
cmp edi, 4
jbe 0x48d6ed
push 2
push 0x400
lea eax, [ebp - 0x16c8]
push eax
lea ecx, [ebp - 0x1cd0]
push ecx
push edi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], bl
jne 0x48d73e
mov ecx, dword [ebp + 0x18]
push edi
cmp dword [ebp - 0xf5f4], ebx
je 0x48d71f
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp - 0xf5f4]
push edx
push eax
push ecx
push esi
push str.___d______d__Into_Flt_Clbk__KHand__0x_x__dwf__0x_x___Pid___ld_
lea edx, [ebp - 0x13bc]
push edx
jmp 0x48d7b7
mov eax, dword [ebp + 0x28]
push eax
push ecx
push esi
lea edx, [ebp - 0x13bc]
push str.___d______d__Into_Flt_Clbk__KHand__NULL__dwf__0x_x___Pid___ld_
push edx
call fcn.005dfb23
add esp, 0x18
jmp 0x48d7bf
lea eax, [ebp - 0x1cd0]
push 0x5c
push eax
call fcn.005e0a00
add esp, 8
cmp eax, ebx
jne 0x48d761
lea ecx, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], ecx
jmp 0x48d768
inc eax
mov dword [ebp - 0xf604], eax
mov eax, dword [ebp - 0xf5f4]
cmp eax, ebx
je 0x48d79a
mov ecx, dword [ebp + 0x28]
lea edx, [ebp - 0x1cd0]
push edx
mov edx, dword [ebp + 0x18]
push edi
push ecx
push eax
push edx
push esi
lea eax, [ebp - 0x13bc]
push str.___d______d__Into_Flt_Clbk__KHand__0x_x__dwf__0x_x___Pid___ld__PN:_s__
push eax
call fcn.005dfb23
add esp, 0x20
jmp 0x48d7bf
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x1cd0]
push ecx
push edi
push edx
push eax
push esi
push str.___d______d__Into_Flt_Clbk__KHand__NULL__dwf__0x_x___Pid___ld__PN:_s__
lea ecx, [ebp - 0x13bc]
push ecx
call fcn.005dfb23
add esp, 0x1c
mov edx, dword [0x71de6c]
push ebx
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
mov ecx, dword [0x71de6c]
add esp, 0x10
test byte [ebp + 0x28], 4
mov edx, 1
je 0x48d7f2
mov dword [ebp - 0xf668], edx
mov eax, dword [0x685b84]
cmp eax, edx
jne 0x48d8cb
cmp dword [ebp - 0xf5f4], ebx
jne 0x48d8cb
cmp ecx, ebx
je 0x48d823
push ebx
push ecx
push str.Kernel_Handle_Not_Available_For_Scanning_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov ecx, 7
mov esi, str.FILTER_VERDICT_COULD_NOT_SCAN
lea edi, [ebp - 0x78bc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [0x71de6c], ebx
je 0x48d887
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xf740]
mov edx, dword [ebp - 0xf6f0]
push eax
lea ecx, [ebp - 0x78bc]
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str.___d__Out_of_Flt_Clbk_1_.___s____u_ms_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
mov eax, dword [0x732b8c]
test eax, eax
jle 0x48d8c1
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0x732b8c
call esi
mov eax, dword [0x733104]
cmp eax, ebx
je 0x48d8c1
cmp dword [ebp - 0xf798], ebx
jne 0x48d8c1
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x48d8c1
mov edx, dword [0x733104]
add edx, 4
push edx
call esi
mov eax, 6
jmp 0x49b03b
cmp dword [0x6b07b0], ebx
jne 0x49aa5a
cmp dword [0x6e91b8], edx
je 0x49aa62
cmp dword [0x6b0760], ebx
jne 0x49aa5a
cmp dword [ebp - 0xf620], ebx
je 0x48d9bf
cmp word [0x741488], bx
je 0x48d93e
mov eax, dword [ebp - 0xf620]
push 0x741488
push eax
call fcn.0060678d
add esp, 8
test eax, eax
jne 0x48d935
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x49aadb
push ebx
push eax
push str.SAMEFILE
jmp 0x49aace
xor ecx, ecx
mov word [0x741488], cx
mov eax, dword [ebp - 0xf620]
lea edx, [ebp - 0xf5f0]
push edx
push eax
mov dword [ebp - 4], ebx
call fcn.004da960
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x49aa43
mov eax, dword [ebp - 0xf5f0]
cmp eax, ebx
je 0x49aa43
cmp byte [eax], 0
je 0x49aa43
cmp dword [0x6e9188], 0
jne 0x48d9fa
mov edi, dword [ebp - 0xf620]
push edi
call fcn.004da8b0
add esp, 4
test eax, eax
je 0x48d9ac
mov ecx, dword [ebp - 0xf5f0]
push ecx
call fcn.004dad50
add esp, 4
test eax, eax
je 0x48da20
push edi
call fcn.004da8e0
mov edi, eax
add esp, 4
mov dword [ebp - 0xf644], edi
jmp 0x48da26
cmp ecx, ebx
je 0x49aae0
push ebx
push ecx
push str.No_FileName_Provided_By_The_Bd_Engine
jmp 0x49aace
push eax
call fcn.004dad50
add esp, 4
test eax, eax
je 0x48da20
mov edx, dword [ebp - 0xf620]
push edx
call fcn.004da8e0
mov edi, eax
add esp, 4
mov dword [ebp - 0xf644], edi
jmp 0x48da26
mov edi, dword [ebp - 0xf644]
cmp dword [0x71de6c], 0
je 0x48da6f
mov eax, dword [ebp - 0xf60c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xf5f0]
push eax
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str.Intercept_Callback_Received_For_FileName:___s___BdId:__d__RPid:__ld
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
mov eax, dword [ebp - 0xf5f0]
push eax
mov dword [esi*4 + 0x6e91fc], 1
mov dword [ebp - 4], 2
call fcn.004fb2f0
mov ecx, dword [ebp - 0xf5f0]
cmp byte [ecx], 0x5c
jne 0x48dbba
mov edx, ecx
cmp byte [edx + 1], 0x5c
jne 0x48dbba
push 0x40f
lea eax, [ebp - 0x91ff]
push 0
push eax
mov byte [ebp - 0x9200], 0
call fcn.005dfd60
mov eax, dword [0x71de6c]
add esp, 0xc
test eax, eax
je 0x48dae3
push 0
push eax
push str.ConvertUNC
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov edx, dword [ebp - 0xf5f0]
lea ecx, [ebp - 0x9200]
push ecx
push edx
call fcn.0050fb90
cmp eax, 1
jne 0x48dbba
cmp byte [ebp - 0x9200], 0
je 0x48dbba
cmp dword [0x71de6c], 0
je 0x48db50
mov ecx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x9200]
push eax
push ecx
lea edx, [ebp - 0x13bc]
push str.Converted___s__to___s_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
test edi, edi
je 0x48db67
push edi
call fcn.004da940
add esp, 4
mov dword [ebp - 0xf644], 0
mov edx, dword [ebp - 0xf5f0]
push edx
call fcn.005e0865
lea eax, [ebp - 0x9200]
add esp, 4
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48db80
sub eax, edx
inc eax
push eax
call fcn.005e20e4
add esp, 4
mov dword [ebp - 0xf5f0], eax
test eax, eax
je 0x49aafb
lea ecx, [ebp - 0x9200]
mov edx, eax
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x48dbb0
mov dword [ebp - 4], 0xffffffff
cmp dword [0x71de6c], 0
mov edi, dword [ebp - 0xf644]
mov esi, dword [ebp - 0xf60c]
mov ebx, dword [ebp + 0x20]
je 0x48dc2a
mov eax, dword [0x6e91c4]
mov ecx, dword [ebp - 0xf668]
mov edx, dword [0x6862e0]
push esi
push esi
push ebx
push eax
mov eax, dword [0x686200]
push ecx
mov ecx, dword [0x72d004]
push edx
push eax
push ecx
lea edx, [ebp - 0x13bc]
push str.EPS_A:__d__DCE:__d__EPS_E:__d__FBS:__d__dwLF:__d__dwFS:__lu__rPID:__u__0x_x_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x38
cmp dword [0x72d004], 0
mov dword [ebp - 4], 4
je 0x48e57f
cmp dword [0x6e91c4], 0
je 0x48e57f
test ebx, ebx
jbe 0x48e57f
cmp dword [ebp - 0xf668], 0
je 0x48e47f
mov eax, dword [ebp - 0xf5f0]
xor edi, edi
cmp byte [eax], 0x5c
mov byte [ebp - 0xf68d], 0
mov dword [ebp - 0xf5fc], 1
jne 0x48dccb
cmp byte [eax + 1], 0x5c
jne 0x48dccb
lea edx, [ebp - 0x3a8]
push str.DRIVE_NETWORK
push edx
call fcn.005dfb23
add esp, 8
test byte [0x6e91c4], 4
jmp 0x48dd7d
xor eax, eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov byte [ebp - 0x2f], al
mov eax, dword [ebp - 0xf5f0]
mov byte [ebp - 0x38], 0
mov bl, byte [eax]
movsx ecx, bl
push ecx
lea edx, [ebp - 0x38]
push 0x61fff0
push edx
call fcn.005dfb23
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
call fcn.004e9b10
lea ecx, [ebp - 0x3a8]
mov esi, eax
push ecx
push esi
call fcn.0045d720
mov dl, byte [0x6e91c4]
add esp, 8
test dl, 1
je 0x48dd32
cmp esi, 2
je 0x48dd27
cmp esi, 5
jne 0x48dd32
mov byte [ebp - 0xf68d], bl
mov edi, 1
test dl, 2
je 0x48dd7a
cmp esi, 3
jne 0x48dd7a
cmp dword [0x6861e4], 0
je 0x48dd75
mov al, byte [0x6b08d8]
mov cl, al
sub cl, 0x61
cmp cl, 0x19
movsx ecx, al
ja 0x48dd5a
sub ecx, 0x20
mov al, byte [ebp - 0x38]
mov bl, al
sub bl, 0x61
movsx eax, al
cmp bl, 0x19
ja 0x48dd6d
sub eax, 0x20
cmp ecx, eax
jne 0x48dd75
xor edi, edi
jmp 0x48dd7a
mov edi, 1
test dl, 4
je 0x48dd84
mov edi, 1
mov dword [ebp - 0xf5fc], 2
test edi, edi
je 0x48e57f
cmp dword [0x6861e0], 0
jne 0x48e57f
push 0x3ff
lea edx, [ebp - 0x5c6b]
push 0
push edx
mov byte [ebp - 0x5c6c], 0
call fcn.005dfd60
push 0x3ff
lea eax, [ebp - 0x545b]
push 0
push eax
mov byte [ebp - 0x545c], 0
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x3307]
push 0
push ecx
mov byte [ebp - 0x3308], 0
call fcn.005dfd60
push 0x103
lea edx, [ebp - 0x3203]
push 0
push edx
mov byte [ebp - 0x3204], 0
call fcn.005dfd60
push 0x103
lea eax, [ebp - 0x30ff]
push 0
push eax
mov byte [ebp - 0x3100], 0
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x483b]
push 0
push ecx
mov byte [ebp - 0x483c], 0
call fcn.005dfd60
add esp, 0x48
push 0x3ff
lea edx, [ebp - 0x6683]
mov edi, 0x104
push 0
push edx
mov dword [ebp - 0xf820], edi
mov dword [ebp - 0xf824], edi
mov dword [ebp - 0xf748], 0
mov byte [ebp - 0x6684], 0
call fcn.005dfd60
push 0x207
lea eax, [ebp - 0x4223]
push 0
push eax
mov byte [ebp - 0x4224], 0
call fcn.005dfd60
mov al, byte [ebp - 0xf68d]
add esp, 0x18
test al, al
je 0x48df2d
movsx ecx, al
push ecx
lea edx, [ebp - 0x483c]
push str.SoftwareMicroWorldDeviceControlUSBDevices_c
push edx
call fcn.005dfb23
lea eax, [ebp - 0xf748]
push eax
push 1
push 0
lea ecx, [ebp - 0x483c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
test eax, eax
jne 0x48df2d
mov ecx, dword [ebp - 0xf748]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0xf820]
push edx
lea eax, [ebp - 0x3204]
push eax
push 0
push 0
push str.SerialNo
push ecx
call esi
mov ecx, dword [ebp - 0xf748]
lea edx, [ebp - 0xf824]
push edx
lea eax, [ebp - 0x3100]
push eax
push 0
push 0
push str.FriendlyName
push ecx
call esi
mov edx, dword [ebp - 0xf748]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x6af8c8
push 0x400
lea eax, [ebp - 0x5c6c]
push eax
push str.File_Modified_or_Copied
push 0x63b6c8
push 0x614348
call esi
push 0x6af8c8
push edi
lea ecx, [ebp - 0x3308]
push ecx
push str.No_Action
push 0x61d148
push str.Prompt
call esi
cmp byte [ebp - 0x3204], 0
je 0x48dfc8
lea edx, [ebp - 0x3204]
push edx
lea eax, [ebp - 0x545c]
push str.__SN:_s_
push eax
call fcn.005dfb23
lea eax, [ebp - 0x545c]
add esp, 0xc
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48dfa0
lea edi, [ebp - 0x5c6c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48dfb0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x3100], 0
je 0x48e01c
lea ecx, [ebp - 0x3100]
push ecx
lea edx, [ebp - 0x545c]
push str.__FN:_s_
push edx
call fcn.005dfb23
lea eax, [ebp - 0x545c]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48dff4
lea edi, [ebp - 0x5c6c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48e004
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xf644]
xor edi, edi
cmp esi, edi
je 0x48e242
cmp byte [esi], 0
je 0x48e242
push 0x5c
push esi
mov dword [ebp - 0xf828], edi
call fcn.005e0a00
add esp, 8
cmp eax, edi
jne 0x48e04e
mov eax, esi
jmp 0x48e04f
inc eax
lea ecx, [ebp - 0xf828]
push ecx
lea edx, [ebp - 0x4224]
push edx
mov edx, dword [ebp + 0x20]
push esi
lea ecx, [ebp - 0x6684]
push ecx
push eax
push edx
mov dword [ebp - 0xf5fc], 5
call fcn.00541790
add esp, 0x18
cmp eax, edi
je 0x48e17b
lea eax, [ebp - 0x4224]
push eax
lea ecx, [ebp - 0x6684]
push ecx
lea edx, [ebp - 0x545c]
push str.__SRC_s___PN:_s_
push edx
call fcn.005dfb23
lea eax, [ebp - 0x545c]
add esp, 0x10
mov edx, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e0b0
lea edi, [ebp - 0x5c6c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48e0c0
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [ebp - 0xf644]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x4224]
push eax
lea ecx, [ebp - 0x6684]
push ecx
push edx
lea eax, [ebp - 0x3a8]
push eax
lea ecx, [ebp - 0x87e8]
push str.__s______s__SRC_s__PN:_s_
push ecx
call fcn.005dfb23
lea edx, [ebp - 0x87e8]
push edx
push 0x6af0a8
call fcn.004313e0
add esp, 0x20
cmp dword [0x71de6c], 0
je 0x48e22d
mov ecx, dword [ebp - 0xf644]
mov edx, dword [ebp + 0x20]
lea eax, [ebp - 0x6684]
push eax
push ecx
push edx
lea eax, [ebp - 0xea30]
push str._MAP__Query_UTF8_Success__u:_Dest:_s:_Src:_s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0xea30]
push edx
push 0x6aec98
call fcn.004311c0
mov edx, dword [ebp - 0xf644]
add esp, 0x24
mov dword [ebp - 0xf5fc], 6
jmp 0x48e453
lea eax, [ebp - 0x545c]
push str.__SRCNewFile_
push eax
call fcn.005dfb23
lea eax, [ebp - 0x545c]
add esp, 8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e197
lea edi, [ebp - 0x5c6c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48e1a7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xf644]
push esi
lea ecx, [ebp - 0x3a8]
push ecx
lea edx, [ebp - 0x87e8]
push str.__s______s__SRCNewFile
push edx
call fcn.005dfb23
lea eax, [ebp - 0x87e8]
push eax
push 0x6af0a8
call fcn.004313e0
add esp, 0x18
cmp dword [0x71de6c], 0
je 0x48e22d
mov ecx, dword [ebp + 0x20]
push esi
push ecx
lea edx, [ebp - 0xda30]
push str._MAP__Query_UTF8_Fail__u:_Dest:_s:_Src:NEWFILE
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0xda30]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov edx, dword [ebp - 0xf644]
mov dword [ebp - 0xf5fc], 6
jmp 0x48e453
mov edx, dword [ebp - 0xf5f0]
push 0x5c
push edx
mov dword [ebp - 0xf818], edi
call fcn.005e0a00
add esp, 8
cmp eax, edi
jne 0x48e265
mov eax, dword [ebp - 0xf5f0]
jmp 0x48e266
inc eax
lea ecx, [ebp - 0xf818]
push ecx
mov ecx, dword [ebp - 0xf5f0]
lea edx, [ebp - 0x4224]
push edx
push ecx
lea edx, [ebp - 0x6684]
push edx
push eax
mov eax, dword [ebp + 0x20]
push eax
mov dword [ebp - 0xf5fc], 7
call fcn.00541790
add esp, 0x18
cmp eax, edi
je 0x48e38b
lea ecx, [ebp - 0x4224]
push ecx
lea edx, [ebp - 0x6684]
push edx
lea eax, [ebp - 0x545c]
push str.__SRC_s___PN:_s_
push eax
call fcn.005dfb23
lea eax, [ebp - 0x545c]
add esp, 0x10
mov edx, eax
jmp 0x48e2d0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e2d0
lea edi, [ebp - 0x5c6c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48e2e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0xf5f0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4224]
push ecx
lea edx, [ebp - 0x6684]
push edx
push eax
lea ecx, [ebp - 0x3a8]
push ecx
lea edx, [ebp - 0x87e8]
push str.__s______s__SRC_s__PN:_s_
push edx
call fcn.005dfb23
lea eax, [ebp - 0x87e8]
push eax
push 0x6af0a8
call fcn.004313e0
add esp, 0x20
cmp dword [0x71de6c], 0
je 0x48e443
mov edx, dword [ebp - 0xf5f0]
mov eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x6684]
push ecx
push edx
push eax
lea ecx, [ebp - 0xd230]
push str._MAP__Query_ANSI_Success__u:_Dest:_s:_Src:_s
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0xd230]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
jmp 0x48e443
lea ecx, [ebp - 0x545c]
push str.__SRCNewFile_
push ecx
call fcn.005dfb23
lea eax, [ebp - 0x545c]
add esp, 8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e3a7
lea edi, [ebp - 0x5c6c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48e3b7
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [ebp - 0xf5f0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
lea eax, [ebp - 0x3a8]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x87e8]
push str.__s______s__SRCNewFile
push ecx
call fcn.005dfb23
lea edx, [ebp - 0x87e8]
push edx
push 0x6af0a8
call fcn.004313e0
add esp, 0x18
cmp dword [0x71de6c], 0
je 0x48e443
mov eax, dword [ebp - 0xf5f0]
mov ecx, dword [ebp + 0x20]
push eax
push ecx
lea edx, [ebp - 0xe630]
push str._MAP__Query_ANSI_Fail__u:_Dest:_s:_Src:NEWFILE
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0xe630]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov edx, dword [ebp - 0xf5f0]
mov dword [ebp - 0xf5fc], 8
push 0
push edx
lea eax, [ebp - 0x3308]
push eax
lea ecx, [ebp - 0x5c6c]
push ecx
push 0x60c810
push 0
push str.eScan_Monitor
push 0x82
call fcn.00513910
jmp 0x48e57f
cmp byte [ebp - 0x1cd0], 0
mov dword [ebp - 0xf7d8], 0
mov dword [ebp - 0xf5fc], 9
jne 0x48e4f2
cmp esi, 4
jbe 0x48e4f2
push 4
push 0x400
lea edx, [ebp - 0x16c8]
push edx
lea eax, [ebp - 0x1cd0]
push eax
push esi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x48e4f2
lea ecx, [ebp - 0x1cd0]
push 0x5c
push ecx
call fcn.005e0a00
add esp, 8
test eax, eax
jne 0x48e4eb
lea edx, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], edx
jmp 0x48e4f2
inc eax
mov dword [ebp - 0xf604], eax
mov dword [ebp - 0xf5fc], 0xa
test edi, edi
je 0x48e5b0
cmp byte [edi], 0
je 0x48e5b0
push 0x5c
push edi
call fcn.005e0a00
mov esi, eax
add esp, 8
test esi, esi
jne 0x48e522
mov esi, edi
jmp 0x48e523
inc esi
cmp dword [0x71de6c], 0
je 0x48e55c
push edi
push ebx
lea eax, [ebp - 0x13bc]
push str._MAP__Adding_UTF8__u:_s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
lea eax, [ebp - 0xf7d8]
push eax
lea ecx, [ebp - 0x1cd0]
push ecx
mov dword [ebp - 0xf5fc], 0xb
push edi
push esi
push ebx
call fcn.00544da0
add esp, 0x14
xor ebx, ebx
mov dword [ebp - 4], 6
mov dword [ebp - 0xf750], ebx
cmp dword [0x67e110], ebx
jne 0x48e673
mov eax, 1
mov dword [ebp - 0xf6cc], eax
mov dword [ebp - 0xf6fc], eax
jmp 0x48eb25
mov edx, dword [ebp - 0xf5f0]
push 0x5c
push edx
call fcn.005e0a00
mov esi, eax
add esp, 8
test esi, esi
jne 0x48e5cf
mov esi, dword [ebp - 0xf5f0]
jmp 0x48e5d0
inc esi
cmp dword [0x71de6c], 0
je 0x48e615
mov ecx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x1cd0]
push eax
push ecx
push ebx
lea edx, [ebp - 0x13bc]
push str._MAP__Adding_ANSI__u:_s___s_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
mov ecx, dword [ebp - 0xf5f0]
lea edx, [ebp - 0xf7d8]
push edx
lea eax, [ebp - 0x1cd0]
push eax
mov dword [ebp - 0xf5fc], 0xe
push ecx
jmp 0x48e575
mov eax, dword [ebp - 0xf5f0]
lea edx, [ebp - 0x37c]
push edx
push eax
mov dword [ebp - 0xf750], 1
call fcn.004da790
add esp, 8
cmp byte [ebp - 0x37c], 0
jne 0x48e6bb
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x48e70b
push ebx
push eax
push str.No_File_Extension_Present
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x48e70b
cmp dword [0x71de6c], ebx
je 0x48e6f6
lea ecx, [ebp - 0x37c]
push ecx
lea edx, [ebp - 0x13bc]
push str.____Physical_Extension:__s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
lea edx, [ebp - 0x37c]
push edx
call fcn.004dd6c0
add esp, 4
mov dword [ebp - 0xf674], eax
mov ecx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x2bec]
push eax
push ecx
mov dword [ebp - 0xf750], 2
call fcn.00453170
add esp, 8
cmp byte [ebp - 0x37c], 0
je 0x48e7b1
lea edx, [ebp - 0x2bec]
push 0x2e
push edx
call fcn.005e0a00
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x48e773
lea eax, [ebp - 0x2bec]
push 0x2e
push eax
mov byte [esi], 0
call fcn.005e0a00
add esp, 8
mov dword [ebp - 0xf648], eax
mov byte [esi], 0x2e
cmp eax, ebx
je 0x48e773
inc eax
mov dword [ebp - 0xf648], eax
cmp byte [ebp - 0x37c], 0
je 0x48e7b1
lea ecx, [ebp - 0x37c]
push 0x62577c
push ecx
call fcn.004dd620
add esp, 8
cmp eax, ebx
je 0x48e7ac
lea edx, [ebp - 0x37c]
push 0x63b5a0
push edx
call fcn.004dd620
add esp, 8
cmp eax, ebx
jne 0x48e7b1
mov ebx, 1
mov eax, dword [ebp - 0xf5f0]
mov edi, dword [0x7302f8]
push 0x5c
push eax
mov dword [ebp - 0xf750], 3
call fcn.005e0940
add esp, 8
mov esi, eax
test ebx, ebx
jne 0x48e8e5
cmp byte [ebp - 0x37c], bl
je 0x48e8c0
mov ecx, dword [ebp - 0xf5f0]
push 0x732fb0
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48e96c
cmp byte [ebp - 0x37c], bl
je 0x48e8c0
lea edx, [ebp - 0x2bec]
push str.vsigns.dat
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48e96c
cmp byte [ebp - 0x37c], bl
je 0x48e8c0
lea eax, [ebp - 0x2bec]
push str.EVCACHE.DAT
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48e96c
cmp byte [ebp - 0x37c], bl
je 0x48e8c0
lea ecx, [ebp - 0x2bec]
push str.eupdate.ini
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48e96c
cmp byte [ebp - 0x37c], bl
je 0x48e8c0
lea edx, [ebp - 0x2bec]
push str.mailscan.ini
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48e96c
cmp byte [ebp - 0x37c], bl
je 0x48e8c0
lea eax, [ebp - 0x2bec]
push str.microsoft.exchange.
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x48e96c
test esi, esi
je 0x48e8e5
mov al, byte [esi + 1]
cmp al, 0x56
je 0x48e8cf
cmp al, 0x76
jne 0x48e8e5
push str.Virtual_Machine
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x48e96c
test edi, edi
jne 0x48e985
mov ecx, dword [ebp - 0xf5f0]
add ecx, 3
push str.System_Volume_Information
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x48e96c
mov edx, dword [ebp - 0xf5f0]
inc edx
push str.:_Windows.BT_
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x48e96c
mov eax, dword [ebp - 0xf5f0]
inc eax
push str.:RECYCLER_
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x48e96c
mov ecx, dword [ebp - 0xf5f0]
inc ecx
push str.:Windows.old_
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x48e96c
mov edx, dword [ebp - 0xf5f0]
inc edx
push str.:_Recycle.Bin_
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x48e985
mov dword [ebp - 0xf6cc], 1
mov dword [ebp - 0xf6fc], 2
jmp 0x48eb25
test ebx, ebx
jne 0x48eb18
cmp dword [0x7302f4], ebx
jne 0x48eb18
mov eax, dword [ebp - 0xf674]
push eax
mov esi, dword [ebp - 0xf60c]
lea ecx, [ebp - 0xf750]
push ecx
mov ecx, dword [ebp - 0xf5f8]
lea edx, [ebp - 0xf6fc]
push edx
lea eax, [ebp - 0xf6cc]
push eax
push ebx
push ecx
lea edx, [ebp - 0xf810]
push edx
mov edx, dword [0x7302f8]
lea eax, [ebp - 0xf604]
push eax
push 0x400
lea ecx, [ebp - 0x1cd0]
push ecx
push esi
push ebx
push edx
mov edx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x37c]
push eax
lea ecx, [ebp - 0x2bec]
push ecx
push edx
call fcn.005d2f70
add esp, 0x40
cmp dword [ebp - 0xf6cc], ebx
je 0x48eb18
cmp byte [ebp - 0x37c], bl
je 0x48eb18
lea eax, [ebp - 0x37c]
push 0x61c038
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48eb18
lea eax, [ebp - 0x2bec]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48ea40
sub eax, edx
cmp eax, 0x64
jbe 0x48eb18
cmp byte [ebp - 0x1cd0], cl
jne 0x48eab2
cmp esi, 4
jbe 0x48eab2
push 5
push 0x400
lea ecx, [ebp - 0x16c8]
push ecx
lea edx, [ebp - 0x1cd0]
push edx
push esi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x48eab2
lea eax, [ebp - 0x1cd0]
push 0x5c
push eax
call fcn.005e0a00
add esp, 8
test eax, eax
jne 0x48eaa9
lea eax, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], eax
jmp 0x48eabc
inc eax
mov dword [ebp - 0xf604], eax
jmp 0x48eab8
mov eax, dword [ebp - 0xf604]
test eax, eax
je 0x48eb18
cmp byte [eax], 0
je 0x48eb18
push str.wscript.exe
push eax
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x48eb18
push esi
lea ecx, [ebp - 0x1cd0]
push ecx
lea edx, [ebp - 0x13bc]
push str._XML__Process___s:_d__ForceBypass.
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
push 8
lea ecx, [ebp - 0x1cd0]
push esi
push ecx
call fcn.0045b2a0
add esp, 0x10
cmp dword [ebp - 0xf6cc], 1
jne 0x48ebc4
mov eax, dword [ebp - 0xf5f0]
test eax, eax
je 0x49aafb
cmp dword [0x71de6c], 0
je 0x48eb72
mov edx, dword [ebp - 0xf6fc]
push edx
push eax
lea eax, [ebp - 0x13bc]
push str.SUP_CL_File:__s___u_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp dword [0x72bcb0], 0
jne 0x48eb88
cmp dword [0x71de6c], 0
je 0x49aafb
mov eax, dword [ebp - 0xf6fc]
mov ecx, dword [ebp - 0xf5f0]
push eax
push ecx
push str._s___u_
lea edx, [ebp - 0x13bc]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x13bc]
push eax
push 0x6b1c38
call fcn.004311c0
add esp, 0x20
jmp 0x49aafb
mov ecx, dword [ebp - 0xf5f0]
push 1
push ecx
lea edx, [ebp - 0x2bec]
push edx
call fcn.00450170
add esp, 0xc
cmp eax, 1
jne 0x48ec79
mov eax, dword [ebp - 0xf5f0]
test eax, eax
je 0x49aafb
cmp dword [0x71de6c], 0
je 0x48ec31
push eax
lea eax, [ebp - 0x13bc]
push str.MONITOR_EXCLUDED_File:__s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
mov eax, dword [ebp - 0xf5f0]
add esp, 0x1c
cmp dword [0x72bcb0], 0
jne 0x48ec47
cmp dword [0x71de6c], 0
je 0x49aafb
mov ecx, dword [ebp - 0xf6fc]
push ecx
push eax
push str._MON_EXCL___s___u_
jmp 0x48eb9b
push 0x15
xor edi, edi
call fcn.00441890
lea ecx, [ebp - 0x2bec]
push str.hh.dat
push ecx
mov dword [ebp - 4], 8
call fcn.004dd620
add esp, 0xc
cmp eax, edi
jne 0x48ed1a
cmp dword [0x6e91a8], edi
jne 0x48ed1a
mov ebx, 1
mov dword [ebp - 0xf7b0], ebx
cmp dword [0x732a84], edi
jne 0x48ed1a
mov dword [0x732a84], ebx
cmp dword [0x72bb6c], edi
jne 0x48ed1a
push edi
push edi
push 0x4452f0
call fcn.005e07ac
mov esi, eax
push edi
push esi
push str.CBD_7j
call fcn.00420720
add esp, 0x18
cmp esi, 0xffffffff
jne 0x48ed1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x79c0]
push str.Error:_beginthread_a2__fails_with_error__d
push edx
call fcn.005dfb23
push edi
push ebx
lea eax, [ebp - 0x79c0]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [0x72c4ac], edi
cmp dword [0x68628c], edi
je 0x48eeca
cmp dword [ebp - 0xf668], edi
je 0x48eeca
mov ecx, dword [ebp - 0xf5f0]
inc ecx
push str.:_settings.ini
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x48eeca
mov edx, dword [ebp - 0xf5f4]
push edx
call fcn.004d90d0
add esp, 4
cmp eax, edi
je 0x48eeca
mov eax, dword [ebp - 0xf5f8]
add eax, 0x21
push eax
mov dword [ebp - 0xf81c], edi
mov dword [ebp - 0xf674], edi
call fcn.004d9470
mov esi, eax
add esp, 4
cmp esi, edi
je 0x48eeca
mov ecx, dword [ebp - 0xf5f4]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push ecx
call ebx
mov ecx, dword [ebp - 0xf5f4]
push 0
lea edx, [ebp - 0xf81c]
push edx
mov edi, eax
mov eax, dword [ebp - 0xf5f8]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48ee07
push 0
push str.General_
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x48edf7
push 0
push str.Uninstaller_
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x48ee07
mov eax, 1
mov dword [ebp - 0xf674], eax
mov dword [0x72c4ac], eax
mov edx, dword [ebp - 0xf5f4]
push 0
push 0
push edi
push edx
call ebx
push esi
call fcn.005e0865
add esp, 4
cmp dword [ebp - 0xf674], 0
je 0x48eeca
mov eax, dword [0x741484]
test eax, eax
je 0x48ee40
cmp eax, dword [ebp - 0xf60c]
je 0x48eeca
mov esi, dword [ebp - 0xf60c]
push esi
lea eax, [ebp - 0xa828]
push str._MEM_SCAN__Force_Terminating_PID:_u_as_it_is_modifying_Uninstaller_File_
push eax
mov dword [0x741484], esi
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0xa828]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push esi
push 0
push 0x46aba0
call fcn.005e07ac
mov esi, eax
push 0
push esi
push str.CBD_7cR
call fcn.00420720
add esp, 0x18
cmp esi, 0xffffffff
jne 0x48eeca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x83e8]
push str.Error:_beginthread_w__fails_with_error__d
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x83e8]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [0x71de6c]
test eax, eax
je 0x48eee8
push 0
push eax
push str.SearchEDL
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov ecx, dword [ebp - 0xf5f0]
push ecx
push 0
call fcn.004ce2a0
mov esi, 1
add esp, 8
cmp eax, esi
jne 0x48ef4f
cmp dword [0x71de6c], 0
je 0x48ef40
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x13bc]
push str.Excluded_Drive:_Not_Going_Into_Callback_For_FileName:__s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x15
call fcn.004418a0
add esp, 4
jmp 0x49aafb
cmp dword [0x6e915c], 0
je 0x48efd5
mov eax, dword [0x71de6c]
test eax, eax
je 0x48ef76
push 0
push eax
push str.SearchEXFL
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [ebp - 0xf5f0]
push eax
call fcn.004cd4d0
add esp, 4
cmp eax, esi
jne 0x48efd5
cmp dword [0x71de6c], 0
je 0x48efc6
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0x13bc]
push str.Exclude_Folder:_Not_Going_Into_Callback_For_FileName:__s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x15
call fcn.004418a0
add esp, 4
jmp 0x49aafb
cmp dword [0x7330dc], esi
jne 0x48f0a5
cmp dword [0x7330d8], esi
jne 0x48f05c
cmp dword [0x6e9164], esi
jne 0x48f0a5
cmp dword [0x68630c], 0
je 0x48f0a5
push 0
push esi
push str.Re_Enabling_NWScan...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0
push 0
push 0
push 0x2000107
mov dword [0x7330d8], 0
call dword [0x6e9118]
add esp, 0x10
push 0
push esi
push 0
push 0x200010d
call dword [0x6e9118]
add esp, 0x10
push 0
push 0
push 0
push 0x2000110
call dword [0x6e9118]
add esp, 0x10
cmp dword [0x7330d8], 0
jne 0x48f0a5
cmp dword [0x7330d4], 6
jne 0x48f0a5
cmp dword [0x68630c], 0
je 0x48f0a5
push 0
push esi
push str.Re_Disabling_NWScan...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0
push esi
push 0
push 0x2000107
mov dword [0x7330d8], esi
call dword [0x6e9118]
add esp, 0x10
mov edx, dword [ebp - 0xf5f0]
cmp byte [edx], 0
je 0x48f4c0
cmp byte [ebp - 0x37c], 0
mov dword [ebp - 0xf674], 0
je 0x48f45a
lea eax, [ebp - 0x37c]
push 0x63b5a0
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48f45a
push 0x103
lea ecx, [ebp - 0x2bec]
push ecx
lea edx, [ebp - 0x3a14]
push edx
call fcn.004d5c40
add esp, 0xc
lea eax, [ebp - 0x3a14]
push 0x2e
push eax
call fcn.005e0a00
add esp, 8
test eax, eax
je 0x48f2e4
mov byte [eax], 0
lea eax, [ebp - 0x3a14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48f127
sub eax, edx
cmp eax, 3
jb 0x48f2e4
mov byte [ebp + eax - 0x3a16], cl
mov eax, dword [ebp - 0xf5f0]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48f150
sub eax, edx
add eax, 0x100
push eax
call fcn.005e20e4
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x48f2e4
mov ecx, dword [ebp - 0xf5f0]
mov edx, ebx
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x48f180
push 0x5c
push ebx
call fcn.005e0a00
add esp, 8
test eax, eax
je 0x48f19c
inc eax
jmp 0x48f19e
mov eax, ebx
mov byte [eax], 0
lea eax, [ebp - 0x3a14]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x48f1b0
mov edi, ebx
sub eax, ecx
mov esi, ecx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48f1c0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48f1e0
mov cx, word [0x66d664]
mov word [edi], cx
cmp byte [ebp - 0x1cd0], al
jne 0x48f254
cmp dword [ebp - 0xf60c], 4
jbe 0x48f254
mov ecx, dword [ebp - 0xf60c]
push 4
push 0x400
lea edx, [ebp - 0x16c8]
push edx
lea eax, [ebp - 0x1cd0]
push eax
push ecx
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x48f254
lea edx, [ebp - 0x1cd0]
push 0x5c
push edx
call fcn.005e0a00
add esp, 8
test eax, eax
jne 0x48f24d
lea eax, [ebp - 0x1cd0]
jmp 0x48f24e
inc eax
mov dword [ebp - 0xf604], eax
lea ecx, [ebp - 0x1cd0]
push ebx
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x48f2cd
push 0x7ff
push eax
lea edx, [ebp - 0xe22f]
push edx
mov byte [ebp - 0xe230], al
call fcn.005dfd60
mov eax, dword [ebp - 0xf5f0]
mov esi, dword [ebp - 0xf60c]
push eax
lea ecx, [ebp - 0x1cd0]
push ecx
push esi
lea edx, [ebp - 0xe230]
push str._HUNT__Force_Terminating_Process_PID:_u___s__as_it_accessed_driver___s_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0xe230]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x30
push 0
push esi
mov edi, 1
call fcn.0050fb00
jmp 0x48f2d3
mov edi, dword [ebp - 0xf674]
push ebx
call fcn.005e0865
add esp, 4
test edi, edi
jne 0x48f44e
lea ecx, [ebp - 0x2bec]
push str.kEvP.sys
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x48f318
lea edx, [ebp - 0x2bec]
push str.kEvP64.sys
push edx
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x48f45a
push 0x7ff
lea eax, [ebp - 0xc62f]
push 0
push eax
mov byte [ebp - 0xc630], 0
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x4e53]
push 0
push ecx
mov byte [ebp - 0x4e54], 0
call fcn.005dfd60
mov edx, dword [ebp - 0xf5f0]
mov esi, dword [ebp - 0xf60c]
push edx
lea eax, [ebp - 0x1cd0]
push eax
push esi
lea ecx, [ebp - 0xc630]
push str._POWTOOL__Force_Terminating_Process_PID:_u___s__as_it_accessed_driver___s_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0xc630]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x3c
push 0
push esi
mov edi, 1
call fcn.0050fb00
mov ecx, dword [ebp - 0xf5f0]
push edi
lea eax, [ebp - 0x4e54]
push eax
push ecx
call fcn.00454de0
mov eax, dword [ebp - 0xf5f0]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48f3b7
sub eax, edx
add eax, 0x100
push eax
call fcn.005e20e4
mov esi, eax
add esp, 4
test esi, esi
je 0x48f44e
mov ecx, dword [ebp - 0xf5f0]
mov edx, esi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x48f3e0
push 0x5c
push esi
call fcn.005e0a00
add esp, 8
test eax, eax
je 0x48f3fc
inc eax
jmp 0x48f3fe
mov eax, esi
mov byte [eax], 0
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x48f404
mov edx, dword [str.ShellExtend.dll]
mov dword [eax], edx
mov ecx, dword [0x63b288]
mov dword [eax + 4], ecx
mov edx, dword [0x63b28c]
mov dword [eax + 8], edx
mov ecx, dword [0x63b290]
push 1
lea edx, [ebp - 0x4e54]
push edx
push esi
mov dword [eax + 0xc], ecx
call fcn.00454de0
add esp, 0xc
push esi
call fcn.005e0865
add esp, 4
test edi, edi
je 0x48f45a
mov dword [ebp - 0xf6b0], 1
jmp 0x48f47a
mov ecx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0xf738]
push eax
push ecx
call fcn.00454380
add esp, 8
mov dword [ebp - 0xf6b0], eax
test eax, eax
je 0x48f4c0
mov eax, dword [0x71de6c]
test eax, eax
je 0x48f498
push 0
push eax
push str.Already_Present_In_The_Infected_Cache_A_.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x15
call fcn.004418a0
add esp, 4
xor edx, edx
cmp dword [0x685b84], 1
sete dl
lea edx, [edx*8 + 2]
mov dword [ebp - 0xf608], edx
jmp 0x49aafb
cmp byte [ebp - 0x2bec], 0
je 0x491882
mov eax, dword [0x6861f0]
mov dword [ebp - 0xf830], eax
mov eax, dword [0x71de6c]
xor edi, edi
mov dword [ebp - 0xf764], edi
cmp eax, edi
je 0x48f4fd
push edi
push eax
push str.SearchICL
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push edi
lea ecx, [ebp - 0x2bec]
push ecx
push edi
call fcn.00469e50
mov esi, eax
add esp, 0xc
mov dword [ebp - 0xf5fc], esi
cmp esi, edi
jne 0x48f5a5
lea edx, [ebp - 0x2bec]
push 0x3a
push edx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x48f554
mov eax, dword [0x71de6c]
mov esi, 1
mov dword [ebp - 0xf5fc], esi
cmp eax, edi
je 0x48f5ce
push edi
push eax
push str.Forcing_Scan_for_File_with_Streams...
jmp 0x48f598
cmp dword [0x7302f0], edi
je 0x48f5a5
cmp byte [ebp - 0x37c], 0
je 0x48f5a5
lea eax, [ebp - 0x37c]
push 0x63b22c
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x48f5a5
mov eax, dword [0x71de6c]
mov esi, 1
mov dword [ebp - 0xf5fc], esi
cmp eax, edi
je 0x48f5ce
push edi
push eax
push str.Forcing_Scan_for_File__BlockGPEdit_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x71de6c]
cmp eax, edi
je 0x48f5ce
push edi
push eax
cmp esi, 1
jne 0x48f5bc
push str.FL_Include:TRUE
jmp 0x48f5c1
push str.FL_Include:FALSE
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x685b84], edi
je 0x48f973
cmp dword [0x72d24c], edi
je 0x48f973
mov esi, dword [ebp - 0xf60c]
cmp esi, 4
jbe 0x48f979
cmp dword [0x72c240], edi
jne 0x48f979
push esi
lea ecx, [ebp - 0x388]
push str._04x
push ecx
mov dword [ebp - 0xf7f8], edi
mov dword [ebp - 0xf76c], edi
call fcn.005dfb23
add esp, 0xc
push edi
push edi
lea edx, [ebp - 0x388]
push edx
mov ecx, 0x733360
call fcn.004f2f50
cmp eax, edi
jne 0x48fb34
lea eax, [ebp - 0xf764]
push eax
mov eax, dword [ebp - 0xf620]
lea ecx, [ebp - 0xf76c]
push ecx
lea edx, [ebp - 0xf7f8]
push edx
push esi
push eax
call fcn.00440a10
mov ebx, dword [ebp - 0xf764]
add esp, 0x14
mov esi, eax
cmp ebx, edi
jne 0x48f67a
lea ebx, [ebp - 0xf830]
mov dword [ebp - 0xf764], ebx
cmp dword [0x71de6c], edi
je 0x48f6b6
mov ecx, dword [0x6861f4]
push ecx
push esi
lea edx, [ebp - 0x7bc8]
push str.GCF::_Cnt_u__Max_u
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x7bc8]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp esi, dword [0x6861f4]
jb 0x48facb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0xf7f8]
mov esi, eax
sub esi, edx
cmp dword [ebx], edi
jne 0x48f6de
mov ecx, dword [0x6861f0]
mov dword [ebx], ecx
mov ecx, dword [ebp - 0xf620]
cmp word [ecx], 0x5c
jne 0x48f703
cmp word [ecx + 2], 0x5c
jne 0x48f703
mov ecx, dword [0x6861f0]
add ecx, 0x190
cmp dword [ebx], ecx
jae 0x48f703
mov dword [ebx], ecx
cmp dword [0x71de6c], edi
jne 0x48f717
cmp dword [0x72be04], edi
je 0x48f7b8
mov edi, dword [ebp - 0xf76c]
cmp esi, dword [ebx]
jae 0x48f770
test edi, edi
je 0x48f7b8
mov ecx, dword [edi]
test ecx, ecx
je 0x48f738
cmp ecx, 2
jne 0x48f7b8
push esi
push eax
push edx
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x13bc]
push str._PIDINFO__YES_SKIPPING__s__Last:_u__Now:_u__Diff:_u_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
mov dword [edi], 1
jmp 0x48f7b5
test edi, edi
je 0x48f7b8
mov ecx, dword [edi]
test ecx, ecx
je 0x48f77f
cmp ecx, 1
jne 0x48f7b8
push esi
push eax
push edx
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x13bc]
push str._PIDINFO__NOT_SKIPPING__s__Last:_u__Now:_u__Diff:_u_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
mov dword [edi], 2
add esp, 0x28
cmp esi, dword [ebx]
jae 0x48f909
xor esi, esi
mov dword [ebp - 0xf808], esi
cmp dword [0x71de6c], esi
je 0x48f7fc
lea edx, [ebp - 0x81e0]
push str.AddThisFileToPidScanInfo::
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push esi
push eax
lea ecx, [ebp - 0x81e0]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov edi, dword [ebp - 0xf620]
mov ecx, edi
mov edx, 0x741488
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x48f810
mov eax, dword [ebp - 0xf60c]
lea edx, [ebp - 0xf808]
push edx
push eax
push edi
call fcn.00440b50
mov edi, dword [ebp - 0xf5f8]
mov ecx, dword [ebp - 0xf5f0]
mov edx, dword [ebp - 0xf620]
add esp, 0xc
push edi
push 1
push 0
push ecx
push edx
call fcn.004415e0
add esp, 0x14
cmp dword [0x71de6c], 0
jne 0x48f86b
cmp dword [0x72be04], 0
je 0x48f89b
mov eax, dword [ebp - 0xf808]
push eax
lea ecx, [ebp - 0x13bc]
push str._PIDINFO__CleanFileCount:__d
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [0x685b84]
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff4
add eax, 0xd
mov dword [ebp - 0xf608], eax
cmp edi, 0xa00000
jb 0x48f8c4
mov esi, edi
shr esi, 0x14
inc esi
imul esi, esi, 0x7d
jmp 0x48f8e3
mov eax, dword [ebp - 0xf620]
cmp word [eax], 0x5c
jne 0x48f8e3
cmp word [eax + 2], 0x5c
jne 0x48f8e3
mov esi, dword [0x6861f0]
add esi, 0x190
mov eax, dword [0x6861f0]
cmp esi, eax
jae 0x48f8ee
mov esi, eax
push 0x15
mov dword [ebx], esi
mov dword [ebp - 0xf6d0], 1
call fcn.004418a0
add esp, 4
jmp 0x49aafb
cmp dword [0x71de6c], 0
je 0x48f940
lea eax, [ebp - 0x7dd0]
push str.ProcessSkippedFolder_A_::
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x7dd0]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov eax, dword [ebp - 0xf60c]
mov esi, dword [ebp - 0xf620]
push eax
push esi
call fcn.00440910
mov ecx, dword [ebp - 0xf5f8]
mov edx, dword [ebp - 0xf5f0]
add esp, 8
push ecx
push 2
push 1
push edx
push esi
call fcn.004415e0
add esp, 0x14
xor edi, edi
mov esi, dword [ebp - 0xf60c]
cmp dword [0x71de6c], edi
je 0x48f9b7
lea eax, [ebp - 0x37c]
push eax
push esi
push esi
lea ecx, [ebp - 0x76b4]
push str.RequestorPID___u__0x_x___szObjExt___s
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push edi
push edx
lea eax, [ebp - 0x76b4]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp esi, 4
jbe 0x48fd6b
cmp byte [ebp - 0x37c], 0
je 0x48ff1e
lea ecx, [ebp - 0x37c]
push 0x62f418
push ecx
xor ebx, ebx
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x48fb83
lea edx, [ebp - 0x37c]
push edx
call fcn.004e3fc0
add esp, 4
cmp eax, edi
jne 0x48fb83
lea eax, [ebp - 0x37c]
push 0x63b0d8
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x48fb83
lea ecx, [ebp - 0x37c]
push 0x63b0d4
push ecx
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x48fb83
mov esi, dword [ebp - 0xf648]
cmp esi, edi
je 0x48fbc5
cmp byte [esi], bl
je 0x48fbc5
push 0x62f418
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fa97
push esi
call fcn.004e3fc0
add esp, 4
cmp eax, edi
jne 0x48fa97
push 0x63b0d8
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fa97
push 0x63b0d4
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
jne 0x48fbc5
mov al, byte [esi]
cmp al, 0x72
je 0x48faa1
cmp al, 0x52
jne 0x48fac1
mov al, byte [esi + 1]
cmp al, 0x30
jl 0x48fac1
cmp al, 0x32
jg 0x48fac1
mov al, byte [esi + 2]
cmp al, 0x30
jl 0x48fac1
cmp al, 0x39
jg 0x48fac1
mov dword [ebp - 0xf69c], 1
mov ebx, 1
jmp 0x48fc8a
cmp dword [0x71de6c], edi
je 0x48fb06
mov eax, dword [0x6861f0]
push eax
lea ecx, [ebp - 0x73a8]
push str.ProcessSkippedFolder_B_::_MaxDiff_u
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push edi
push edx
lea eax, [ebp - 0x73a8]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov edx, dword [ebp - 0xf5f8]
mov ecx, dword [0x6861f0]
push edx
push 4
mov dword [ebx], ecx
mov eax, dword [ebp - 0xf5f0]
mov ecx, dword [ebp - 0xf620]
push 1
push eax
push ecx
call fcn.004415e0
add esp, 0x14
jmp 0x48f973
mov dword [ebp - 0xf704], 1
cmp dword [0x71de6c], edi
je 0x48f9b7
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x13bc]
push str.______FROM_EEMPTY__________s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x48f979
mov al, byte [ebp - 0x37c]
cmp al, 0x72
je 0x48fb91
cmp al, 0x52
jne 0x48fbb5
mov dl, byte [ebp - 0x37b]
sub dl, 0x30
cmp dl, 2
ja 0x48fbb5
mov al, byte [ebp - 0x37a]
sub al, 0x30
cmp al, 9
ja 0x48fbb5
mov dword [ebp - 0xf69c], 1
mov esi, dword [ebp - 0xf648]
mov ebx, 1
jmp 0x48fc8a
lea ecx, [ebp - 0x37c]
push 0x628354
push ecx
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fc8a
lea edx, [ebp - 0x37c]
push 0x62f414
push edx
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fc8a
lea eax, [ebp - 0x37c]
push 0x62f408
push eax
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fc8a
lea ecx, [ebp - 0x37c]
push 0x62f404
push ecx
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fc8a
cmp esi, edi
je 0x48fd71
cmp byte [esi], 0
je 0x48fd71
push 0x628354
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fc8a
push 0x62f414
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fc8a
push 0x62f408
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fc8a
push 0x62f404
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
jne 0x48fd71
cmp byte [ebp - 0x1cd0], 0
jne 0x48fcec
mov ecx, dword [ebp - 0xf60c]
push 6
push 0x400
lea edx, [ebp - 0x16c8]
push edx
lea eax, [ebp - 0x1cd0]
push eax
push ecx
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x48fcec
lea edx, [ebp - 0x1cd0]
push 0x5c
push edx
call fcn.005e0a00
add esp, 8
cmp eax, edi
jne 0x48fce3
lea eax, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], eax
jmp 0x48fcf6
inc eax
mov dword [ebp - 0xf604], eax
jmp 0x48fcf2
mov eax, dword [ebp - 0xf604]
cmp eax, edi
je 0x48fd13
push eax
call fcn.00476de0
add esp, 4
cmp eax, edi
mov eax, dword [ebp - 0xf604]
je 0x48fd13
mov dword [ebp - 0xf694], 1
cmp dword [0x71de6c], edi
je 0x48fd71
cmp eax, edi
je 0x48fd71
mov ecx, dword [ebp - 0xf694]
push ecx
push eax
lea edx, [ebp - 0x37c]
push edx
lea eax, [ebp - 0x13bc]
cmp ebx, edi
je 0x48fd3f
push str.Archive___s__opened_from___s_._MailClient:__u
jmp 0x48fd44
push str.MSO_file___s__opened_from___s_._MailClient:__u
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
add esp, 0x14
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x48fd71
mov esi, dword [ebp - 0xf648]
cmp byte [ebp - 0x37c], 0
je 0x48ff1e
lea eax, [ebp - 0x37c]
push 0x628354
push eax
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fe65
lea ecx, [ebp - 0x37c]
push 0x62f414
push ecx
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fe65
lea edx, [ebp - 0x37c]
push 0x62f408
push edx
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fe65
lea eax, [ebp - 0x37c]
push str.ppsx
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x48fe65
lea ecx, [ebp - 0x37c]
push 0x62f404
push ecx
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fe65
cmp esi, edi
je 0x48fe72
cmp byte [esi], 0
je 0x48fe72
push 0x628354
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fe65
push 0x62f414
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fe65
push 0x62f408
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fe65
push str.ppsx
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48fe65
push 0x62f404
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
jne 0x48fe72
mov ebx, 1
mov dword [ebp - 0xf774], ebx
jmp 0x48fe77
mov ebx, 1
cmp dword [ebp - 0xf6bc], edi
jne 0x48ff2a
lea edx, [ebp - 0x37c]
push 0x628358
push edx
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48ff16
lea eax, [ebp - 0x37c]
push 0x628350
push eax
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48ff16
lea ecx, [ebp - 0x37c]
push 0x63b028
push ecx
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48ff16
cmp esi, edi
je 0x49007c
cmp byte [esi], 0
je 0x49007c
push 0x628358
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48ff16
push 0x628350
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
je 0x48ff16
push 0x63b028
push esi
call fcn.004dd6e0
add esp, 8
cmp eax, edi
jne 0x49007c
mov dword [ebp - 0xf6bc], ebx
jmp 0x48ff2a
cmp dword [ebp - 0xf6bc], edi
je 0x49007c
mov edx, dword [ebp - 0xf5f8]
fild dword [ebp - 0xf5f8]
test edx, edx
jge 0x48ff40
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jnp 0x48ff65
lea eax, [ebp - 0x2bec]
push edi
push eax
call fcn.004ad650
add esp, 8
cmp eax, edi
je 0x49007c
mov dword [ebp - 0xf7fc], edi
cmp dword [0x71de6c], edi
je 0x48ffa6
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0x13bc]
push str._DOC__Checking_Suspicious_XLS_in__s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [ebp - 0xf5f0]
push eax
push edi
lea edx, [ebp - 0xf7fc]
push edx
mov edx, dword [ebp - 0xf5f4]
lea ecx, [ebp - 0xf678]
push ecx
push edi
push edx
push eax
call fcn.004b54b0
mov ecx, dword [ebp - 0xf678]
add esp, 0x1c
cmp eax, edi
jne 0x48ffff
cmp ecx, 0x3e7
je 0x48ffff
cmp ecx, 0x3e5
je 0x48ffff
cmp ecx, 0x230
je 0x48ffff
cmp ecx, 0xe0
je 0x48ffff
cmp ecx, 0x1bd
jne 0x490009
mov dword [ebp - 0xf6f4], 1
cmp dword [0x71de6c], edi
je 0x49007c
mov edx, dword [ebp - 0xf7fc]
push edx
push ecx
push eax
lea eax, [ebp - 0x13bc]
push str._DOC__Result__XLS_:_MacrosPresent:_u__ThisDoc:_u__Inf:_u
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp dword [0x71de6c], edi
je 0x49007c
lea eax, [ebp - 0x13bc]
push str._DOC__Nothing_suspicious_in_Office_Document__XLS_...
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
cmp dword [ebp - 0xf774], edi
je 0x49028b
mov eax, dword [ebp - 0xf5f8]
fild dword [ebp - 0xf5f8]
test eax, eax
jge 0x49009e
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jnp 0x4900c3
lea ecx, [ebp - 0x2bec]
push edi
push ecx
call fcn.004ad650
add esp, 8
cmp eax, edi
je 0x49028b
mov dword [ebp - 0xf78c], edi
cmp dword [0x71de6c], edi
je 0x490105
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x13bc]
push str._DOC__Checking_Suspicious_DOC_in__s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [ebp - 0xf5f0]
push eax
push edi
lea ecx, [ebp - 0xf78c]
push ecx
mov ecx, dword [ebp - 0xf5f4]
lea edx, [ebp - 0xf678]
push edx
push edi
push ecx
mov ebx, 1
push eax
mov dword [0x74ac50], ebx
call fcn.004b54b0
mov esi, eax
mov eax, dword [ebp - 0xf678]
add esp, 0x1c
cmp esi, edi
jne 0x490166
cmp eax, 0x3e7
je 0x490166
cmp eax, 0x3e5
je 0x490166
cmp eax, 0x230
je 0x490166
cmp eax, 0xe0
je 0x490166
cmp eax, 0x1bd
jne 0x49016c
mov dword [ebp - 0xf6f4], ebx
cmp dword [0x71de6c], edi
je 0x4901b0
mov edx, dword [ebp - 0xf78c]
push edx
push eax
push esi
lea eax, [ebp - 0x13bc]
push str._DOC__Result:_MacrosPresent:_u__ThisDoc:_u__Inf:_u
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
mov eax, dword [ebp - 0xf678]
add esp, 0x24
cmp esi, edi
je 0x490249
cmp dword [ebp - 0xf78c], edi
je 0x49028b
cmp dword [ebp - 0xf694], edi
je 0x4901f7
cmp dword [0x6861c8], edi
je 0x4901f7
cmp eax, 0x230
je 0x4901f7
push eax
mov eax, dword [ebp - 0xf5f0]
push eax
push str.Suspicious_Attachment:_s____BLOCKING_2b:_u__Forcing_SCRIPT_
lea ecx, [ebp - 0x13bc]
mov dword [ebp - 0xf640], ebx
push ecx
jmp 0x490229
cmp dword [ebp - 0xf640], edi
je 0x490215
push eax
mov eax, dword [ebp - 0xf5f0]
push eax
push str.Suspicious_Attachment:_s____BLOCKING_2b:_u__Forcing_SCRIPT_
lea ecx, [ebp - 0x13bc]
push ecx
jmp 0x490229
mov edx, dword [ebp - 0xf5f0]
push eax
push edx
push str.Suspicious_Attachment:_s__2b_1:_u__Forcing_SCRIPT_
lea eax, [ebp - 0x13bc]
push eax
call fcn.005dfb23
add esp, 0x10
push edi
push ebx
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49028b
cmp eax, 0x3e7
je 0x49028b
cmp eax, 0x3e5
je 0x49028b
cmp dword [0x71de6c], edi
je 0x49028b
lea edx, [ebp - 0x13bc]
push str._DOC__Nothing_suspicious_in_Office_Document...
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
cmp dword [ebp - 0xf5fc], edi
jne 0x491809
mov edx, dword [ebp - 0xf5f0]
push 0x5c
push edx
call fcn.005e3012
mov ebx, eax
add esp, 8
cmp ebx, edi
jne 0x4902b6
mov ebx, dword [ebp - 0xf5f0]
jmp 0x4902b7
inc ebx
mov eax, dword [0x71de6c]
mov dword [ebp - 0xf674], ebx
cmp eax, edi
je 0x4902da
push edi
push eax
push str.SearchEXCTMAP
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea eax, [ebp - 0xf79c]
push eax
push ebx
mov dword [ebp - 0xf79c], edi
call fcn.00542d90
mov esi, eax
add esp, 8
cmp esi, 1
jne 0x490374
mov ecx, dword [ebp - 0xf5f8]
cmp dword [ebp - 0xf79c], ecx
je 0x490353
push ebx
call fcn.00546720
add esp, 4
cmp dword [0x71de6c], edi
je 0x49037c
mov edx, dword [ebp - 0xf5f8]
mov eax, dword [ebp - 0xf79c]
push edx
push eax
lea ecx, [ebp - 0x75b0]
push str.SearchEXCTMAP___Different_Size__Earlier:0x_x___New:_0x_x_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push edi
push edx
lea eax, [ebp - 0x75b0]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x49037c
mov eax, dword [0x71de6c]
cmp eax, edi
je 0x4917f0
push edi
push eax
push str.SearchEXCTMAP___Success
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp esi, edi
jne 0x4917d2
mov eax, dword [ebp - 0xf5f0]
cmp byte [eax], 0x5c
jne 0x490391
cmp byte [eax + 1], 0x5c
je 0x49055b
cmp dword [0x6e91bc], edi
jne 0x49055b
cmp dword [0x6e91c0], edi
jne 0x49055b
mov eax, dword [0x71de6c]
cmp eax, edi
je 0x4903c6
push edi
push eax
push str.GFAt__LOCAL_FILE____A
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x140
lea ecx, [ebp - 0xeb70]
push edi
push ecx
mov byte [ebp - 4], 9
call fcn.005dfd60
mov edx, dword [ebp - 0xf5f4]
mov ecx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0xeb70]
push eax
push edi
push ecx
call fcn.00454e30
add esp, 0x1c
cmp eax, edi
jne 0x49047d
push 0x103
lea edx, [ebp - 0x505b]
push edi
push edx
mov byte [ebp - 0x505c], 0
call fcn.005dfd60
lea eax, [ebp - 0x505c]
push 0x104
push eax
call fcn.004d8c20
add esp, 0x14
cmp dword [0x71de6c], edi
je 0x49046e
mov edx, dword [ebp - 0xf5f0]
lea ecx, [ebp - 0x505c]
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str.GetFileInformation_Failed_For_The_File:__s.__s.
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0x15
call fcn.004418a0
add esp, 4
jmp 0x49aafb
mov eax, dword [0x71de6c]
cmp eax, edi
je 0x49049a
push edi
push eax
push str.SearchCach_A_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea eax, [ebp - 0x37c]
push eax
mov eax, dword [ebp - 0xf5f0]
lea ecx, [ebp - 0xf6a8]
push ecx
lea edx, [ebp - 0xeb70]
push edx
push eax
call fcn.00453640
mov ebx, 1
add esp, 0x10
mov dword [ebp - 0xf718], eax
mov dword [ebp - 0xf7c8], ebx
mov dword [ebp - 0xf71c], ebx
cmp eax, ebx
jne 0x490554
mov eax, dword [0x71de6c]
cmp eax, edi
je 0x4904f6
push edi
push eax
push str.Already_Present_In_The_Cache_A_.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp - 0xf6c4], 0xffffffff
jne 0x49053f
mov edx, dword [ebp - 0xf5f0]
mov eax, dword [ebp - 0xf704]
mov esi, dword [ebp - 0xf60c]
push ebx
lea ecx, [ebp - 0x37c]
push ecx
push edx
push eax
push esi
call fcn.00467960
add esp, 0x14
mov dword [ebp - 0xf6c4], eax
cmp eax, ebx
jne 0x49053f
mov ecx, dword [ebp - 0xf620]
push edi
push esi
push ecx
call fcn.00440b50
add esp, 0xc
push 0x15
call fcn.004418a0
add esp, 4
mov dword [ebp - 0xf608], ebx
jmp 0x49aafb
mov dword [ebp - 4], 8
mov ebx, dword [ebp - 0xf694]
xor edi, edi
cmp dword [ebp - 0xf670], 0xffffffff
lea esi, [edi + 1]
mov dword [ebp - 0xf720], edi
mov dword [ebp - 0xf5fc], edi
jne 0x49076d
mov eax, dword [0x71de6c]
cmp eax, edi
je 0x49059c
push edi
push eax
push str.IsItSpecF_a_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x15
call fcn.004418a0
lea edx, [ebp - 0xf68c]
push edx
lea eax, [ebp - 0xf650]
push eax
push edi
push edi
push edi
lea ecx, [ebp - 0xf684]
push ecx
lea edx, [ebp - 0xf6e8]
push edx
push edi
lea eax, [ebp - 0xf64c]
push eax
lea ecx, [ebp - 0xf618]
push ecx
lea edx, [ebp - 0xf654]
push edx
mov edx, dword [ebp - 0xf70c]
lea eax, [ebp - 0xf658]
push eax
mov eax, dword [ebp - 0xf6ac]
lea ecx, [ebp - 0xf67c]
push ecx
push edx
push eax
mov eax, dword [ebp - 0xf714]
lea ecx, [ebp - 0xf698]
push ecx
lea edx, [ebp - 0xf664]
push edx
push eax
lea ecx, [ebp - 0xf600]
push ecx
mov ecx, dword [ebp - 0xf5f4]
push edi
push edi
push edi
lea edx, [ebp - 0xf634]
push edx
mov edx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x174]
push eax
push edi
push ecx
push edx
call fcn.004c1560
add esp, 0x70
push 0x15
mov dword [ebp - 0xf670], eax
call fcn.00441890
add esp, 4
cmp dword [ebp - 0xf600], edi
jne 0x4906f2
lea eax, [ebp - 0x174]
push 0x63ad98
push eax
call fcn.005f095a
add esp, 8
cmp dword [ebp - 0xf69c], esi
jne 0x49069d
cmp eax, edi
jne 0x4906b9
jmp 0x4906a1
cmp eax, edi
jne 0x4906f2
lea ecx, [ebp - 0x37c]
push 0x63ad98
push ecx
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x4906f2
mov eax, dword [0x71de6c]
mov dword [ebp - 0xf600], esi
mov dword [ebp - 0x174], 0x4c4355
cmp eax, edi
je 0x4906e6
push edi
push eax
push str.Forcing_ArchScan_1XX_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], esi
mov dword [ebp - 0xf638], edi
cmp dword [0x71de6c], edi
je 0x49076d
mov eax, dword [ebp - 0xf650]
mov ecx, dword [ebp - 0xf64c]
lea edx, [ebp - 0x174]
push edx
mov edx, dword [ebp - 0xf618]
push eax
mov eax, dword [ebp - 0xf654]
push ecx
mov ecx, dword [ebp - 0xf658]
push edx
mov edx, dword [ebp - 0xf67c]
push eax
mov eax, dword [ebp - 0xf698]
push ecx
mov ecx, dword [ebp - 0xf600]
push edx
mov edx, dword [ebp - 0xf634]
push eax
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x40
cmp byte [ebp - 0x174], 0
je 0x4907d3
push edi
push edi
lea eax, [ebp - 0x174]
push eax
mov ecx, 0x7333f8
call fcn.004f2f50
cmp eax, edi
je 0x4907d3
cmp dword [0x71de6c], edi
je 0x4907c8
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x13bc]
push str.Blocked_File_Extension__1__:__s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0xf65c], esi
jmp 0x490896
cmp dword [ebp - 0xf65c], edi
jne 0x49086c
cmp byte [ebp - 0x37c], 0
je 0x49084d
lea edx, [ebp - 0x174]
push edx
lea eax, [ebp - 0x37c]
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x49084d
push edi
push edi
lea ecx, [ebp - 0x37c]
push ecx
mov ecx, 0x7333f8
call fcn.004f2f50
cmp eax, edi
je 0x49084d
cmp dword [0x71de6c], edi
je 0x4907c8
lea edx, [ebp - 0x37c]
push edx
lea eax, [ebp - 0x13bc]
push str.Blocked_File_Extension__2__:__s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
jmp 0x4907bb
mov eax, dword [ebp - 0xf5f0]
push eax
mov dword [ebp - 0xf7d0], esi
call fcn.0045e990
add esp, 4
mov dword [ebp - 0xf65c], eax
cmp eax, edi
jne 0x490896
cmp dword [ebp - 0xf600], edi
jne 0x49089c
cmp dword [ebp - 0xf650], edi
jne 0x49089c
push 5
lea ecx, [ebp - 0x2bec]
push str.eicar
push ecx
call fcn.004dd670
add esp, 0xc
cmp eax, edi
jne 0x49089c
mov dword [ebp - 0xf600], esi
cmp dword [ebp - 0xf6f4], edi
jne 0x4908b4
cmp dword [ebp - 0xf6bc], edi
je 0x49091f
cmp dword [ebp - 0xf618], edi
je 0x49091f
cmp dword [0x71de6c], edi
je 0x4908e8
lea edx, [ebp - 0x13bc]
push str.Forcing_PopExt_to_SCRIPT_1_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov edx, dword [str.SCRIPT]
mov ax, word [0x630114]
mov cl, byte [0x630116]
mov dword [ebp - 0x174], edx
mov word [ebp - 0x170], ax
mov byte [ebp - 0x16e], cl
mov dword [ebp - 0xf654], esi
mov dword [ebp - 0xf600], esi
mov dword [ebp - 0xf658], esi
cmp dword [ebp - 0xf640], edi
jne 0x491706
cmp dword [ebp - 0xf600], edi
jne 0x491706
cmp dword [ebp - 0xf650], edi
jne 0x491706
cmp dword [ebp - 0xf5f8], 0x600000
jae 0x491706
mov eax, dword [ebp - 0xf5f0]
cmp byte [eax], 0x5c
jne 0x490968
cmp byte [eax + 1], 0x5c
je 0x491706
mov dword [ebp - 0xf660], edi
cmp dword [ebp - 0xf634], edi
je 0x491706
lea edx, [ebp - 0x174]
push 0x62f418
push edx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x490bf8
lea eax, [ebp - 0xf678]
push eax
mov eax, dword [ebp - 0xf5f4]
lea ecx, [ebp - 0xf660]
push ecx
push edi
push edi
lea edx, [ebp - 0xf77c]
push edx
mov edx, dword [ebp - 0xf5f0]
push eax
push edi
lea ecx, [ebp - 0xf720]
push ecx
push edx
mov dword [ebp - 0xf77c], edi
call fcn.004b8f20
add esp, 0x24
mov esi, eax
mov dword [ebp - 0xf5fc], esi
cmp dword [0x71de6c], edi
je 0x490a31
mov eax, dword [ebp - 0xf678]
mov ecx, dword [ebp - 0xf68c]
mov edx, dword [ebp - 0xf660]
push eax
mov eax, dword [ebp - 0xf77c]
push ecx
mov ecx, dword [ebp - 0xf720]
push edx
push eax
push ecx
push esi
lea edx, [ebp - 0x13bc]
push str.ZC_1____d_PwdProt___d__PIFSCR___u__OneExe___u__FFExe___u__TDoc___u
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x30
cmp esi, 0xffffffff
jne 0x490a59
cmp dword [ebp - 0xf68c], edi
je 0x490a59
mov eax, 1
mov esi, eax
mov dword [ebp - 0xf5fc], esi
mov dword [ebp - 0xf660], eax
mov dword [ebp - 0xf720], edi
jmp 0x490a93
cmp dword [ebp - 0xf660], edi
jne 0x490a6c
mov dword [ebp - 0xf5fc], edi
jmp 0x491706
mov eax, 1
cmp esi, eax
je 0x490a7e
cmp esi, 0xffffffff
jne 0x490b6b
cmp dword [ebp - 0xf720], edi
je 0x490a93
cmp byte [0x72bba0], 0
je 0x490b6b
mov dword [ebp - 0xf600], eax
cmp esi, eax
jne 0x490aa3
mov dword [ebp - 0xf61c], eax
cmp dword [ebp - 0xf77c], edi
je 0x491706
cmp dword [0x71de6c], edi
je 0x490af2
mov edx, dword [ebp - 0xf5f8]
mov eax, dword [0x6861c4]
push edx
push eax
push ebx
lea ecx, [ebp - 0x13bc]
push str.EMC_1____u_BlockSus___u__dwObjSize___u
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push edi
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp ebx, edi
je 0x491706
cmp dword [0x6861c4], edi
je 0x491706
mov ecx, dword [ebp - 0xf5f8]
fild dword [ebp - 0xf5f8]
test ecx, ecx
jge 0x490b1c
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jp 0x491706
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x13bc]
push str.Suspicious_Attachment:_s____BLOCKING_2_
push eax
call fcn.005dfb23
push edi
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0xf640], 1
jmp 0x491706
cmp esi, eax
je 0x490b78
cmp esi, 0xffffffff
jne 0x491706
cmp dword [ebp - 0xf720], edi
je 0x490b8d
cmp byte [0x72bba0], 0
je 0x491706
lea edx, [ebp - 0x2bec]
push edi
push edx
call fcn.004ad650
add esp, 8
cmp eax, edi
je 0x491706
cmp dword [0x71de6c], edi
je 0x490bda
lea eax, [ebp - 0x13bc]
push str.ZC_1A____Reserved_Name_in_Zip___Setting_infected
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov eax, 1
mov dword [ebp - 0xf600], eax
cmp esi, eax
jne 0x491706
mov dword [ebp - 0xf61c], eax
jmp 0x491706
cmp dword [ebp - 0xf634], edi
je 0x491706
lea eax, [ebp - 0x174]
push 0x634a04
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x490c38
lea ecx, [ebp - 0x174]
push 0x63abc4
push ecx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x490d35
push 0x103
lea edx, [ebp - 0x452f]
push edi
push edx
mov byte [ebp - 0x4530], 0
call fcn.005dfd60
lea eax, [ebp - 0x174]
push 0x634a04
push eax
call fcn.004dd620
add esp, 0x14
xor ecx, ecx
push 0
test eax, eax
push 0
setne cl
push 0
lea edx, [ebp - 0xf660]
push edx
mov edx, dword [ebp - 0xf620]
lea eax, [ebp - 0x4530]
push eax
mov edi, ecx
mov ecx, dword [ebp - 0xf5f4]
push edi
push ecx
push edx
push 0
call fcn.004bc390
add esp, 0x24
cmp dword [0x71de6c], 0
mov esi, eax
je 0x490ce2
mov ecx, dword [ebp - 0xf660]
lea eax, [ebp - 0x4530]
push eax
push ecx
push esi
lea edx, [ebp - 0x13bc]
push str.ISP_ARCH_A_:_rv_u__OneExe_u__ErMsg:_s_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
test esi, esi
je 0x491706
cmp dword [ebp - 0xf660], 0
jne 0x4916ab
cmp dword [0x730094], 0
je 0x491706
cmp byte [ebp - 0x37c], 0
jne 0x491706
mov eax, 1
cmp edi, eax
jne 0x491706
mov dword [ebp - 0xf600], eax
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
jmp 0x491706
cmp dword [ebp - 0xf634], edi
je 0x491706
lea edx, [ebp - 0x174]
push 0x63ab94
push edx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x490d6b
mov eax, dword [ebp - 0xf5f4]
push edi
push eax
call fcn.004aa630
add esp, 8
jmp 0x490d9e
cmp dword [ebp - 0xf634], edi
je 0x491706
lea ecx, [ebp - 0x174]
push 0x63ab90
push ecx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x490dbd
mov edx, dword [ebp - 0xf5f0]
push edx
call fcn.0045e540
add esp, 4
cmp eax, edi
je 0x491706
mov dword [ebp - 0xf600], esi
mov dword [ebp - 0xf5fc], esi
mov dword [ebp - 0xf61c], esi
jmp 0x491706
cmp dword [ebp - 0xf634], edi
je 0x491706
lea eax, [ebp - 0x174]
push 0x63ab8c
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x490f77
mov ebx, dword [ebp - 0xf5f8]
cmp dword [0x71de6c], edi
je 0x490e27
mov ecx, dword [ebp - 0xf668]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push str.ISP_ARCH_A1_:_FBS_u__dwObjSize_u
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp dword [ebp - 0xf668], edi
jne 0x490f45
push 0x103
lea edx, [ebp - 0x340b]
push edi
push edx
mov byte [ebp - 0x340c], 0
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0xf784], edi
xor esi, esi
mov dword [ebp - 0xf7b8], edi
call fcn.004d96c0
cmp eax, edi
je 0x490e77
lea eax, [ebp - 0xf7b8]
push eax
call fcn.004f77e0
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x340c]
push ecx
mov ecx, dword [ebp - 0xf5f0]
lea edx, [ebp - 0xf784]
push edx
lea eax, [ebp - 0xf660]
push eax
push ecx
call fcn.004c1210
add esp, 0x10
cmp eax, edi
je 0x490ec8
cmp dword [ebp - 0xf660], edi
je 0x490ec8
cmp dword [ebp - 0xf784], edi
jne 0x490ec8
mov eax, 1
mov dword [ebp - 0xf600], eax
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
jmp 0x490f29
cmp byte [ebp - 0x340c], 0
je 0x490f29
cmp dword [ebp - 0xf784], edi
jne 0x490efa
cmp dword [ebp - 0xf68c], edi
je 0x490efa
mov eax, 1
mov dword [ebp - 0xf600], eax
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
jmp 0x490f29
lea edx, [ebp - 0x340c]
push edx
lea eax, [ebp - 0x13bc]
push str._ACE__ErMsg1:_s
push eax
call fcn.005dfb23
push edi
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp esi, edi
je 0x491706
mov edx, dword [ebp - 0xf7b8]
push edx
call fcn.004f7860
add esp, 4
jmp 0x491706
cmp ebx, 0x190
jae 0x490f62
mov eax, dword [ebp - 0xf5f4]
push ebx
push eax
call fcn.004aa520
add esp, 8
jmp 0x490d9e
mov dword [ebp - 0xf724], esi
mov dword [ebp - 0xf5fc], 0xffffffff
jmp 0x491706
cmp dword [ebp - 0xf634], edi
je 0x491706
lea ecx, [ebp - 0x174]
push ecx
call fcn.004e3fc0
add esp, 4
cmp eax, edi
je 0x491103
push 0x103
lea edx, [ebp - 0x21e3]
push 0
push edx
mov byte [ebp - 0x21e4], 0
call fcn.005dfd60
mov al, byte [ebp - 0x173]
xor edi, edi
sub al, 0x30
add esp, 0xc
lea ebx, [edi + 1]
cmp al, 2
ja 0x490fca
mov edi, ebx
cmp dword [ebp - 0xf668], 0
push 0
push 0
push 0
je 0x4910b6
mov eax, dword [ebp - 0xf5f4]
lea ecx, [ebp - 0xf660]
push ecx
mov ecx, dword [ebp - 0xf620]
lea edx, [ebp - 0x21e4]
push edx
push 2
push eax
push ecx
push 0
call fcn.004bc390
add esp, 0x24
cmp dword [0x71de6c], 0
mov esi, eax
je 0x49104d
mov eax, dword [ebp - 0xf660]
lea edx, [ebp - 0x21e4]
push edx
push eax
push esi
lea ecx, [ebp - 0x13bc]
push str.ISP_ARCH_B_:_rv_u__OneExe_u__ErMsg:_s_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
test esi, esi
je 0x491075
cmp dword [ebp - 0xf660], 0
jne 0x49105e
test edi, edi
je 0x491075
mov dword [ebp - 0xf600], ebx
mov dword [ebp - 0xf5fc], ebx
mov dword [ebp - 0xf61c], ebx
jmp 0x491706
cmp byte [ebp - 0x21e4], 0
je 0x491706
push 0
lea ecx, [ebp - 0x21e4]
push str.7z_Error
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x491706
mov dword [ebp - 0xf724], ebx
mov dword [ebp - 0xf5fc], 0xffffffff
jmp 0x491706
mov ecx, dword [ebp - 0xf620]
push 0
lea edx, [ebp - 0xf660]
push edx
lea eax, [ebp - 0x21e4]
push eax
push ecx
push 0
call fcn.004ba3d0
add esp, 0x20
test eax, eax
je 0x491706
cmp dword [ebp - 0xf660], 0
je 0x491706
mov dword [ebp - 0xf600], ebx
mov dword [ebp - 0xf5fc], ebx
mov dword [ebp - 0xf61c], ebx
jmp 0x491706
cmp dword [ebp - 0xf634], edi
je 0x491706
lea edx, [ebp - 0x174]
push 0x63b0d8
push edx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x491304
mov eax, dword [ebp - 0xf5f4]
push eax
xor esi, esi
call fcn.004d90d0
add esp, 4
cmp eax, edi
je 0x491153
mov ecx, dword [ebp - 0xf5f4]
push 1
push edi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
mov edx, dword [ebp - 0xf5f4]
mov eax, dword [ebp - 0xf5f0]
push edx
push eax
call fcn.004a93d0
add esp, 8
cmp dword [0x71de6c], 0
mov edi, eax
je 0x4911a3
push edi
lea ecx, [ebp - 0x13bc]
push str.CAB_A____d
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp edi, 1
jne 0x4912d6
push 0x207
lea ecx, [ebp - 0x5e73]
push 0
push ecx
mov byte [ebp - 0x5e74], 0
call fcn.005dfd60
mov edx, dword [ebp - 0xf5f4]
mov ecx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x5e74]
push eax
push ecx
call fcn.004a9680
add esp, 0x18
cmp byte [ebp - 0x5e74], 0
je 0x4912d6
mov edi, dword [ebp - 0xf5f8]
push 0
lea edx, [ebp - 0x5e74]
push edi
push edx
call fcn.004b0510
add esp, 0xc
test eax, eax
je 0x4912d6
cmp dword [0x71de6c], 0
mov eax, 1
mov dword [ebp - 0xf660], eax
mov dword [ebp - 0xf600], eax
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
je 0x49126c
mov eax, dword [0x6861c4]
push edi
push eax
push ebx
lea ecx, [ebp - 0x13bc]
push str.EMC_2____u_BlockSus___u__dwObjSize___u
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
test ebx, ebx
je 0x4912d6
cmp dword [0x6861c4], 0
je 0x4912d6
mov dword [ebp - 0xf69c], edi
fild dword [ebp - 0xf69c]
test edi, edi
jge 0x49128f
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jp 0x4912d6
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0x13bc]
push str.Suspicious_Attachment:_s____BLOCKING_2a_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0xf640], 1
mov ecx, dword [ebp - 0xf5f4]
push ecx
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x491706
mov edx, dword [ebp - 0xf5f4]
push 0
push 0
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x491706
cmp dword [ebp - 0xf634], edi
je 0x491706
mov eax, dword [ebp - 0xf5f8]
fild dword [ebp - 0xf5f8]
mov dword [ebp - 0xf648], edi
test eax, eax
jge 0x49132c
fadd qword [0x60ecc0]
fst qword [ebp - 0xf6a0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jnp 0x491372
lea ecx, [ebp - 0x174]
push 0x63aab8
push ecx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x49162e
fld qword [0x63aab0]
fcomp qword [ebp - 0xf6a0]
fnstsw ax
test ah, 0x41
jne 0x49162e
lea edx, [ebp - 0x174]
push 0x63aaa8
push edx
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x4913be
lea eax, [ebp - 0x174]
push 0x63aaa4
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x4913be
lea ecx, [ebp - 0x174]
push 0x63aab8
push ecx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x49144c
push edi
lea edx, [ebp - 0x2bec]
push str.xlsx.
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x491420
push edi
lea eax, [ebp - 0x2bec]
push str.docx.
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x491420
push edi
lea ecx, [ebp - 0x2bec]
push str.pdf.
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x491420
lea edx, [ebp - 0x2bec]
push edi
push edx
call fcn.004ad650
add esp, 8
cmp eax, edi
je 0x49144c
mov eax, dword [0x71de6c]
mov dword [ebp - 0xf648], esi
cmp eax, edi
je 0x49162e
push edi
push eax
push str.ForceScanArj_set__A_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49162e
lea eax, [ebp - 0x174]
push 0x63aaa8
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x4914ac
mov ecx, dword [ebp - 0xf5f8]
mov edx, dword [ebp - 0xf5f4]
push ecx
push edx
push edi
push edi
call fcn.004aa3c0
add esp, 0x10
cmp eax, edi
je 0x4914ac
mov eax, dword [0x71de6c]
mov dword [ebp - 0xf648], esi
cmp eax, edi
je 0x49162e
push edi
push eax
push str.ForceScanArj_set__B_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49162e
lea eax, [ebp - 0x174]
push 0x63aab8
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x49162e
mov edi, dword [ebp - 0xf5f8]
add edi, 0x401
push edi
mov dword [ebp - 0xf7c0], 0
call fcn.005e20e4
mov esi, eax
add esp, 4
test esi, esi
je 0x49162e
mov ecx, dword [ebp - 0xf5f4]
push ecx
xor ebx, ebx
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x491519
mov edx, dword [ebp - 0xf5f4]
push 1
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
push edi
push 0
push esi
call fcn.005dfd60
mov ecx, dword [ebp - 0xf5f8]
mov edx, dword [ebp - 0xf5f4]
add esp, 0xc
push 0
lea eax, [ebp - 0xf7c0]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x491603
cmp dword [ebp - 0xf7c0], 0x8010
jbe 0x491603
mov al, byte [esi + 0x8000]
cmp al, 1
jne 0x49159d
cmp byte [esi + 0x8001], 0x43
jne 0x49159d
cmp byte [esi + 0x8002], 0x44
jne 0x49159d
cmp byte [esi + 0x8006], al
jne 0x49159d
mov eax, dword [0x71de6c]
mov edi, 1
mov dword [ebp - 0xf648], edi
test eax, eax
je 0x4915e5
push 0
push eax
push str.ForceScanArj_set__C_
jmp 0x4915d8
test al, al
jne 0x491603
cmp byte [esi + 0x8001], 0x42
jne 0x491603
cmp byte [esi + 0x8002], 0x45
jne 0x491603
cmp byte [esi + 0x8006], 1
jne 0x491603
mov eax, dword [0x71de6c]
mov edi, 1
mov dword [ebp - 0xf648], edi
test eax, eax
je 0x4915e5
push 0
push eax
push str.ForceScanArj_set__D_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea eax, [esi + 0x8008]
push str.Win32
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x491603
mov dword [ebp - 0xf6dc], edi
push esi
call fcn.005e0865
mov ecx, dword [ebp - 0xf5f4]
push ecx
call fcn.004d90d0
add esp, 8
test eax, eax
je 0x49162e
mov edx, dword [ebp - 0xf5f4]
push 0
push 0
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0xf5f8]
cmp eax, 0x190
jae 0x49164d
push eax
mov eax, dword [ebp - 0xf5f4]
push eax
call fcn.004aa520
add esp, 8
jmp 0x4916a7
lea ecx, [ebp - 0x174]
push 0x63ab94
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x491677
mov edx, dword [ebp - 0xf5f4]
push eax
push edx
call fcn.004aa630
add esp, 8
jmp 0x4916a7
cmp dword [ebp - 0xf634], 0
je 0x4916c4
lea eax, [ebp - 0x174]
push 0x63ab90
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4916c4
mov ecx, dword [ebp - 0xf5f0]
push ecx
call fcn.0045e540
add esp, 4
test eax, eax
je 0x491706
mov eax, 1
mov dword [ebp - 0xf600], eax
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
jmp 0x491706
cmp dword [ebp - 0xf648], 0
je 0x491706
mov eax, 1
mov dword [ebp - 0xf600], eax
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
mov eax, dword [0x71de6c]
test eax, eax
je 0x491827
push 0
push eax
push str.ForceScanArj_set__FINAL_A_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x71de6c], 0
je 0x4917aa
cmp byte [ebp - 0x174], 0
je 0x49175f
cmp dword [ebp - 0xf600], 0
je 0x491742
lea edx, [ebp - 0x174]
push edx
lea eax, [ebp - 0x13bc]
push str.FileRes:__s__Infectible_
push eax
call fcn.005dfb23
add esp, 0xc
jmp 0x49178a
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x13bc]
push str.FileRes:__s__Non_Infectible_
push edx
call fcn.005dfb23
add esp, 0xc
jmp 0x49178a
cmp dword [ebp - 0xf600], 0
je 0x491776
push str.FileRes:__Infectible_
lea eax, [ebp - 0x13bc]
push eax
jmp 0x491782
push str.FileRes:__Non_Infectible_
lea ecx, [ebp - 0x13bc]
push ecx
call fcn.005dfb23
add esp, 8
mov eax, dword [0x71de6c]
test eax, eax
je 0x4917aa
push 0
push eax
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp - 0xf600], 0
jne 0x491809
cmp dword [ebp - 0xf5fc], 0xffffffff
je 0x4917d2
mov eax, dword [ebp - 0xf5f8]
mov ecx, dword [ebp - 0xf674]
push eax
push ecx
call fcn.00545ca0
add esp, 8
mov eax, dword [0x71de6c]
test eax, eax
je 0x4917f0
push 0
push eax
push str.Include_List:_Not_Present_In_Include_Extentions._So_Skip_The_File
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x15
call fcn.004418a0
add esp, 4
mov dword [ebp - 0xf608], 1
jmp 0x49aafb
mov eax, dword [0x71de6c]
test eax, eax
je 0x491827
push 0
push eax
push str.SearchECL
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0
lea edx, [ebp - 0x2bec]
push edx
push 0
call fcn.00469ff0
add esp, 0xc
cmp eax, 1
jne 0x491882
cmp dword [0x71de6c], 0
je 0x4917f0
lea eax, [ebp - 0x2bec]
push eax
lea ecx, [ebp - 0x13bc]
push str.Strong_Exclude_List:___s__File_Present_In_Strong_Exclude_Extentions._So_Skip_The_File
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x4917f0
push 0x15
call fcn.004418a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0xf5f0]
xor ebx, ebx
cmp byte [esi], 0x5c
jne 0x491d53
cmp byte [esi + 1], 0x5c
jne 0x491d53
mov esi, dword [0x71de6c]
xor edi, edi
mov dword [ebp - 4], 0xc
cmp esi, ebx
je 0x4918db
push ebx
push esi
push str.GFAt__NETWORK_FILE_
push 0x6aec98
call fcn.004311c0
mov esi, dword [0x71de6c]
add esp, 0x10
cmp dword [0x6e9160], 1
jne 0x491b2e
push 0x103
lea ecx, [ebp - 0x2ffb]
push ebx
push ecx
mov byte [ebp - 0x2ffc], 0
call fcn.005dfd60
push 0x103
lea edx, [ebp - 0x4a43]
push ebx
push edx
mov byte [ebp - 0x4a44], 0
call fcn.005dfd60
add esp, 0x18
mov dword [0x6e9160], ebx
cmp esi, ebx
je 0x49193b
push ebx
push esi
push str.Impersonating_Client__a_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push ebx
lea eax, [ebp - 0x4a44]
push eax
lea ecx, [ebp - 0x2ffc]
push ecx
call fcn.00504d70
cmp eax, ebx
jne 0x491aea
push 0x17
call fcn.00441890
mov eax, dword [0x6e9884]
add esp, 4
cmp eax, ebx
je 0x491986
cmp byte [eax], 0
je 0x491986
push 0x2c
lea edx, [ebp - 0x2ffc]
push edx
push eax
call fcn.004e5460
cmp eax, ebx
jne 0x491aaa
push 0x3ff
lea eax, [ebp - 0xa61f]
push ebx
push eax
mov byte [ebp - 0xa620], 0
call fcn.005dfd60
push 0x103
lea ecx, [ebp - 0x20df]
push ebx
push ecx
mov byte [ebp - 0x20e0], 0
call fcn.005dfd60
add esp, 0x18
push 1
push 0x2c
lea edx, [ebp - 0x2ffc]
push edx
push 0x6e9884
mov dword [ebp - 0xf838], 0x400
call fcn.004e5820
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x4919f7
push ebx
push eax
push str.Getting_Legacy_Name
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea eax, [ebp - 0xf838]
push eax
lea ecx, [ebp - 0xa620]
push ecx
call fcn.004fd470
cmp eax, 1
jne 0x491aaa
push ebx
lea edx, [ebp - 0x20e0]
push edx
call fcn.004dc7e0
cmp dword [0x71de6c], ebx
je 0x491a62
lea eax, [ebp - 0x20e0]
push eax
lea ecx, [ebp - 0xa620]
push ecx
lea edx, [ebp - 0x13bc]
push str.Legacy_Name:__s._Mac_Name:__s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
lea edx, [ebp - 0x20e0]
push edx
call fcn.004e24e0
lea eax, [ebp - 0x20e0]
add esp, 4
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491a80
sub eax, edx
push eax
lea eax, [ebp - 0x20e0]
push eax
lea ecx, [ebp - 0xa620]
push ecx
call fcn.005e3491
add esp, 0xc
test eax, eax
je 0x491aaa
mov dword [0x684f84], ebx
push 0x17
call fcn.004418a0
add esp, 4
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x491b28
mov esi, dword [0x71de6c]
cmp esi, ebx
je 0x491b2e
lea edx, [ebp - 0x4a44]
push edx
lea eax, [ebp - 0x13bc]
push str.Impersonation__8__Failed._Reason:__s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov esi, dword [0x71de6c]
mov eax, dword [0x684f84]
cmp eax, 0xffffffff
je 0x491b80
cmp eax, 5
jge 0x491b80
inc eax
mov dword [0x684f84], eax
cmp esi, ebx
je 0x49aafb
push 5
push eax
lea eax, [ebp - 0x13bc]
push str.Skip_File__CSCFS____d__d_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x49aafb
cmp dword [ebp - 0xf5f4], ebx
jne 0x491bf5
push 0x207
lea eax, [ebp - 0x89ef]
push ebx
push eax
mov byte [ebp - 0x89f0], 0
call fcn.005dfd60
add esp, 0xc
push ebx
lea ecx, [ebp - 0x89f0]
push ecx
push ebx
call fcn.00504d70
cmp eax, ebx
je 0x491bea
lea edx, [ebp - 0x89f0]
push edx
lea eax, [ebp - 0x13bc]
push str.Impersonation_Failed._Reason:__s
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x49aafb
mov esi, dword [0x71de6c]
mov edi, 1
cmp esi, ebx
je 0x491c0d
push ebx
push esi
push str.GFAxx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x140
lea edx, [ebp - 0xeb70]
push ebx
push edx
call fcn.005dfd60
mov eax, dword [ebp - 0xf5f4]
mov edx, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0xeb70]
push ecx
push ebx
push edx
call fcn.00454e30
add esp, 0x1c
cmp eax, ebx
jne 0x491cc8
push 0x103
lea eax, [ebp - 0x4c4b]
push ebx
push eax
mov byte [ebp - 0x4c4c], 0
call fcn.005dfd60
lea ecx, [ebp - 0x4c4c]
push 0x104
push ecx
call fcn.004d8c20
add esp, 0x14
cmp dword [0x71de6c], ebx
je 0x491cb5
mov eax, dword [ebp - 0xf5f0]
lea edx, [ebp - 0x4c4c]
push edx
push eax
lea ecx, [ebp - 0x13bc]
push str.GetFileInformation_Failed_For_The_File:__s.__s.
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push ebx
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp edi, ebx
je 0x49aafb
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x49aafb
cmp edi, ebx
je 0x491cd2
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov dword [ebp - 4], 0xffffffff
xor ebx, ebx
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x491cf8
push ebx
push eax
push str.Pre_Point1
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, 1
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xf69c], ebx
cmp dword [0x685b84], eax
jne 0x491e5e
cmp dword [ebp + 0x28], 0x40
jne 0x491e6d
cmp dword [ebp - 0xf60c], 4
jmp 0x491e65
cmp dword [ebp - 0xf7c8], ebx
jne 0x491cdb
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x491d7e
push ebx
push eax
push str.GFAt__LOCAL_FILE_
push 0x6aec98
call fcn.004311c0
mov esi, dword [ebp - 0xf5f0]
add esp, 0x10
push 0x140
lea ecx, [ebp - 0xeb70]
push ebx
push ecx
mov dword [ebp - 4], 0xe
call fcn.005dfd60
mov edx, dword [ebp - 0xf5f4]
push edx
lea eax, [ebp - 0xeb70]
push eax
push ebx
push esi
call fcn.00454e30
add esp, 0x1c
cmp eax, ebx
jne 0x491e2b
push 0x103
lea ecx, [ebp - 0x442b]
push ebx
push ecx
mov byte [ebp - 0x442c], 0
call fcn.005dfd60
lea edx, [ebp - 0x442c]
push 0x104
push edx
call fcn.004d8c20
add esp, 0x14
cmp dword [0x71de6c], ebx
je 0x49aafb
mov ecx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x442c]
push eax
push ecx
lea edx, [ebp - 0x13bc]
push str.GetFileInformation_Failed_For_The_File:__s.__s.
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x49aafb
mov dword [ebp - 4], 0xffffffff
jmp 0x491cdb
cmp dword [ebp - 0xf60c], 8
jne 0x491e6d
mov dword [ebp - 0xf73c], eax
cmp byte [ebp - 0x37c], 0
je 0x491ea3
lea edx, [ebp - 0x37c]
push 0x63b5a0
push edx
call fcn.004dd620
add esp, 8
cmp eax, ebx
je 0x491ea3
lea eax, [ebp - 0x37c]
push eax
call fcn.004ad3a0
add esp, 4
mov dword [ebp - 0xf6b8], eax
cmp dword [ebp - 0xf6b8], ebx
jne 0x4920bb
cmp dword [0x6e91bc], ebx
jne 0x491ec3
cmp dword [0x6e91c0], ebx
je 0x49208c
cmp dword [ebp - 0xf670], 0xffffffff
jne 0x49208c
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x491eed
push ebx
push eax
push str.IsItSpecF_b_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea ecx, [ebp - 0xf68c]
push ecx
lea edx, [ebp - 0xf650]
push edx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xf684]
push eax
lea ecx, [ebp - 0xf6e8]
push ecx
push ebx
lea edx, [ebp - 0xf64c]
push edx
lea eax, [ebp - 0xf618]
push eax
lea ecx, [ebp - 0xf654]
push ecx
mov ecx, dword [ebp - 0xf70c]
lea edx, [ebp - 0xf658]
push edx
mov edx, dword [ebp - 0xf6ac]
lea eax, [ebp - 0xf67c]
push eax
push ecx
push edx
mov edx, dword [ebp - 0xf714]
lea eax, [ebp - 0xf698]
push eax
lea ecx, [ebp - 0xf664]
push ecx
push edx
lea eax, [ebp - 0xf600]
push eax
mov eax, dword [ebp - 0xf5f4]
push ebx
push ebx
push ebx
lea ecx, [ebp - 0xf634]
push ecx
mov ecx, dword [ebp - 0xf5f0]
lea edx, [ebp - 0x174]
push edx
push ebx
push eax
push ecx
call fcn.004c1560
add esp, 0x6c
mov dword [ebp - 0xf670], eax
cmp dword [0x71de6c], ebx
je 0x492003
mov eax, dword [ebp - 0xf650]
mov ecx, dword [ebp - 0xf64c]
lea edx, [ebp - 0x174]
push edx
mov edx, dword [ebp - 0xf618]
push eax
mov eax, dword [ebp - 0xf654]
push ecx
mov ecx, dword [ebp - 0xf658]
push edx
mov edx, dword [ebp - 0xf67c]
push eax
mov eax, dword [ebp - 0xf698]
push ecx
mov ecx, dword [ebp - 0xf600]
push edx
mov edx, dword [ebp - 0xf634]
push eax
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x40
cmp dword [ebp - 0xf6f4], ebx
jne 0x49201b
cmp dword [ebp - 0xf6bc], ebx
je 0x49208c
cmp dword [ebp - 0xf618], ebx
je 0x49208c
cmp dword [0x71de6c], ebx
je 0x492050
lea eax, [ebp - 0x13bc]
push str.Forcing_PopExt_to_SCRIPT_2_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov eax, dword [str.SCRIPT]
mov cx, word [0x630114]
mov dl, byte [0x630116]
mov dword [ebp - 0x174], eax
mov eax, 1
mov word [ebp - 0x170], cx
mov byte [ebp - 0x16e], dl
mov dword [ebp - 0xf654], eax
mov dword [ebp - 0xf600], eax
mov dword [ebp - 0xf658], eax
cmp dword [ebp - 0xf618], 1
jne 0x4920bb
lea eax, [ebp - 0x37c]
push 0x63b5a0
push eax
call fcn.004dd620
add esp, 8
cmp eax, ebx
jne 0x4920bb
cmp dword [0x6e91bc], ebx
je 0x4920bb
mov dword [ebp - 0xf618], ebx
cmp dword [ebp - 0xf65c], ebx
jne 0x492406
cmp dword [ebp - 0xf7d0], ebx
jne 0x4920ec
mov ecx, dword [ebp - 0xf5f0]
push ecx
call fcn.0045e990
add esp, 4
mov dword [ebp - 0xf65c], eax
cmp eax, ebx
jne 0x492406
cmp dword [0x6e91bc], ebx
je 0x492406
cmp dword [ebp - 0xf6b8], ebx
jne 0x49210c
cmp dword [ebp - 0xf618], ebx
je 0x492406
cmp dword [ebp - 0xf73c], ebx
je 0x492406
cmp dword [ebp - 0xf650], ebx
jne 0x492406
xor esi, esi
cmp byte [0x741380], 0
jne 0x492197
mov ecx, 0x6b08d8
mov edx, 0x741380
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x492140
push 0x741380
call fcn.004e24e0
add esp, 4
push str.spool_
push 0x741380
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.004d96c0
cmp eax, ebx
je 0x492197
push 0x741380
push 0x741278
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x61b114
push 0x61b108
push 0x741278
call fcn.004e9030
add esp, 0xc
push 0x741380
call fcn.004dd6c0
mov edx, dword [ebp - 0xf5f0]
add esp, 4
push eax
push 0x741380
push edx
call fcn.004dd670
add esp, 0xc
cmp eax, ebx
je 0x492406
cmp byte [0x741278], 0
je 0x4921f4
push 0x741278
call fcn.004dd6c0
add esp, 4
push eax
mov eax, dword [ebp - 0xf5f0]
push 0x741278
push eax
call fcn.004dd670
add esp, 0xc
cmp eax, ebx
je 0x492406
cmp esi, ebx
jne 0x492406
push 0x3ff
lea ecx, [ebp - 0x6c8b]
push ebx
push ecx
xor edi, edi
mov byte [ebp - 0x6c8c], 0
call fcn.005dfd60
mov eax, dword [0x72c284]
add esp, 0xc
cmp eax, ebx
je 0x492301
cmp byte [eax], 0
je 0x492301
push 1
push ebx
push 0x2c
lea edx, [ebp - 0xf788]
push edx
lea ecx, [ebp - 0x6c8c]
push ecx
mov dword [ebp - 0xf788], ebx
push eax
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0xf788], 0xffffffff
je 0x4922f9
cmp byte [ebp - 0x6c8c], 0x21
je 0x492292
lea edx, [ebp - 0x6c8c]
push edx
call fcn.004dd6c0
mov ecx, dword [ebp - 0xf5f0]
add esp, 4
push eax
lea eax, [ebp - 0x6c8c]
push eax
push ecx
call fcn.004dd670
add esp, 0xc
cmp eax, ebx
jmp 0x4922d4
lea edx, [ebp - 0x6c8b]
push edx
call fcn.004dd6c0
mov ecx, dword [ebp - 0xf5f0]
add esp, 4
mov esi, eax
push esi
lea eax, [ebp - 0x6c8b]
push eax
push ecx
call fcn.004dd670
add esp, 0xc
cmp eax, ebx
jne 0x4922da
mov edx, dword [ebp - 0xf5f0]
lea eax, [esi + edx]
push 0x5c
push eax
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4923c4
mov edx, dword [0x72c284]
push 1
push ebx
push 0x2c
lea eax, [ebp - 0xf788]
push eax
lea ecx, [ebp - 0x6c8c]
push ecx
push edx
jmp 0x49224a
cmp edi, ebx
jne 0x4923c4
cmp dword [0x6861a4], ebx
je 0x492380
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x492326
push ebx
push eax
push str.Getting_Connected_Users...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.004480e0
cmp dword [0x6861a4], ebx
je 0x492380
cmp dword [0x72bddc], ebx
ja 0x492380
cmp dword [0x71de6c], ebx
je 0x492406
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x13bc]
push str.FILE:___s__ALLOWED_FROM_Network_Drive_ACCESS_as_Zero_Connected_Users.
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push ebx
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x492406
mov ecx, dword [0x72bddc]
mov edx, dword [ebp - 0xf5f0]
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str.FILE:___s__BLOCKED_FROM_Network_Drive_ACCESS__Users:_u_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
mov dword [ebp - 0xf66c], 1
jmp 0x492403
cmp dword [0x71de6c], ebx
je 0x492406
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x6c8c]
push ecx
lea edx, [ebp - 0x13bc]
push str.FOLDER:___s__Excluded._So_allowing_access_of___s_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0x1a
call fcn.00441890
add esp, 4
cmp dword [ebp - 0xf65c], ebx
jne 0x492620
cmp dword [ebp - 0xf66c], ebx
jne 0x492620
cmp dword [0x6e91c0], ebx
je 0x492620
cmp dword [ebp - 0xf6b8], ebx
jne 0x492448
cmp dword [ebp - 0xf618], ebx
je 0x492620
mov ecx, dword [ebp - 0xf5f0]
cmp byte [ecx + 1], 0x3a
jne 0x492620
xor eax, eax
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x3f], eax
mov byte [ebp - 0x3b], al
mov byte [ebp - 0x44], 0
movsx edx, byte [ecx]
push edx
lea eax, [ebp - 0x44]
push 0x61fff0
push eax
call fcn.005dfb23
add esp, 0xc
lea ecx, [ebp - 0x44]
push ecx
call fcn.004e9b10
cmp eax, 2
jne 0x492620
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x3b18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.TMP3344.TMP
lea ecx, [ebp - 0x3b18]
push ecx
mov byte [ebp - 0x3b15], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x3b18]
push 0x60cf08
push edx
call fcn.005e00ad
add esp, 8
cmp eax, ebx
je 0x492620
push eax
call fcn.005dff6d
lea eax, [ebp - 0x3b18]
push eax
call fcn.004e0670
mov esi, dword [0x72c288]
add esp, 8
mov edi, 1
cmp esi, ebx
je 0x4925de
cmp byte [esi], 0
je 0x4925de
push 0x3ff
lea ecx, [ebp - 0xa21f]
push ebx
push ecx
mov byte [ebp - 0xa220], 0
call fcn.005dfd60
push edi
push ebx
push 0x2c
lea edx, [ebp - 0xf778]
push edx
lea eax, [ebp - 0xa220]
push eax
push esi
mov dword [ebp - 0xf778], ebx
call fcn.004e1380
add esp, 0x24
cmp dword [ebp - 0xf778], 0xffffffff
je 0x4925da
mov edx, dword [ebp - 0xf5f0]
push ebx
lea ecx, [ebp - 0xa220]
push ecx
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4925b3
cmp dword [0x71de6c], ebx
je 0x492620
mov ecx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0xa220]
push eax
push ecx
lea edx, [ebp - 0x13bc]
push str.FILE:__s_NOT_BLOCKED_FROM_USB_Drive_as_its_part_of_Exclusion___s_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x492620
mov ecx, dword [0x72c288]
push 1
push ebx
push 0x2c
lea edx, [ebp - 0xf778]
push edx
lea eax, [ebp - 0xa220]
push eax
push ecx
call fcn.004e1380
add esp, 0x18
jmp 0x492542
cmp edi, ebx
je 0x492620
cmp dword [0x71de6c], ebx
je 0x49261a
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x13bc]
push str.FILE:__s_BLOCKED_FROM_USB_Drive
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0xf680], edi
cmp dword [ebp - 0xf668], ebx
je 0x4928a4
cmp dword [0x6b07a0], ebx
jne 0x4928a4
cmp dword [0x72c01c], ebx
je 0x4928a4
mov esi, dword [ebp - 0xf5f0]
movsx eax, byte [0x732878]
movsx ecx, byte [esi]
sub eax, 0x20
sub ecx, 0x20
cmp eax, ecx
jne 0x4928a4
push 0x103
lea edx, [ebp - 0x5767]
push ebx
push edx
mov byte [ebp - 0x5768], 0
call fcn.005dfd60
push ebx
push str.startup
push esi
call fcn.004f5880
add esp, 0x18
cmp eax, 0xffffffff
jne 0x4926ad
mov eax, dword [ebp - 0xf5f0]
push ebx
push str.tasks
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4928a4
mov edx, dword [ebp - 0xf60c]
lea ecx, [ebp - 0x5768]
push ecx
push edx
call fcn.00541550
add esp, 8
cmp eax, 2
je 0x492870
mov edx, dword [0x72c01c]
push 1
push ebx
push 0x2c
lea eax, [ebp - 0xf790]
push eax
lea ecx, [ebp - 0x688c]
push ecx
mov dword [ebp - 0xf790], ebx
xor esi, esi
push edx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0xf790], 0xffffffff
je 0x49278f
lea eax, [ebp - 0x688c]
push eax
call fcn.004dd6c0
mov edx, dword [ebp - 0xf5f0]
add esp, 4
push eax
lea ecx, [ebp - 0x688c]
push ecx
push edx
call fcn.004dd670
add esp, 0xc
cmp eax, ebx
jne 0x492770
cmp dword [0x71de6c], ebx
je 0x492797
mov eax, dword [0x6861cc]
push eax
lea ecx, [ebp - 0x688c]
push ecx
lea edx, [ebp - 0x13bc]
push str._XSS__File_In_Startup_Task:___s___u_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x492797
mov ecx, dword [0x72c01c]
push 1
push ebx
push 0x2c
lea edx, [ebp - 0xf790]
push edx
lea eax, [ebp - 0x688c]
push eax
push ecx
jmp 0x4926ee
cmp esi, ebx
je 0x4928a4
cmp dword [0x6861cc], ebx
je 0x4928a4
mov edx, dword [ebp - 0xf620]
mov eax, dword [ebp - 0xf6f0]
mov dword [ebp - 0xefa0], edx
mov dword [ebp - 0xefa4], eax
mov dword [ebp - 0xefb0], ebx
cmp dword [0x71de6c], ebx
je 0x4927fc
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0x13bc]
push str.Starting_MonitorFolderThread_for:__s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp dword [0x72bb6c], ebx
jne 0x4928a4
lea edx, [ebp - 0xefb0]
push edx
push ebx
push 0x45d7d0
call fcn.005e07ac
mov esi, eax
push ebx
push esi
push str.CBD_7k
call fcn.00420720
add esp, 0x18
cmp esi, 0xffffffff
jne 0x492861
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x7ac4]
push str.Error:_beginthread_a3__fails_with_error__d
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x7ac4]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x4928a4
cmp dword [ebp - 0xefb0], ebx
jne 0x4928a4
call fcn.004e03f0
jmp 0x492861
cmp dword [0x71de6c], ebx
je 0x4928a4
lea edx, [ebp - 0x13bc]
push str._XSS__Ignoring_startup_change.
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
cmp dword [ebp - 0xf65c], ebx
jne 0x49291b
cmp dword [ebp - 0xf66c], ebx
jne 0x49291b
cmp dword [ebp - 0xf680], ebx
jne 0x49291b
cmp dword [ebp - 0xf640], ebx
jne 0x49291b
cmp dword [ebp - 0xf71c], ebx
jne 0x49290f
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x4928e9
push ebx
push eax
push str.SearchCach
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea edx, [ebp - 0x37c]
push edx
mov edx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0xf6a8]
push eax
lea ecx, [ebp - 0xeb70]
push ecx
push edx
call fcn.00453640
add esp, 0x10
jmp 0x492915
mov eax, dword [ebp - 0xf718]
mov dword [ebp - 0xf69c], eax
mov esi, dword [ebp - 0xf6a8]
mov edi, 1
cmp dword [ebp - 0xf69c], edi
jne 0x4929aa
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x49294b
push ebx
push eax
push str.Already_Present_In_The_Cache.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp - 0xf6c4], 0xffffffff
jne 0x492995
mov edx, dword [ebp - 0xf5f0]
mov eax, dword [ebp - 0xf704]
mov esi, dword [ebp - 0xf60c]
push 2
lea ecx, [ebp - 0x37c]
push ecx
push edx
push eax
push esi
call fcn.00467960
add esp, 0x14
mov dword [ebp - 0xf6c4], eax
cmp eax, edi
jne 0x492995
mov ecx, dword [ebp - 0xf620]
push ebx
push esi
push ecx
call fcn.00440b50
add esp, 0xc
push 0x1a
call fcn.004418a0
add esp, 4
mov dword [ebp - 0xf608], edi
jmp 0x49aafb
cmp dword [ebp - 0xf65c], ebx
jne 0x492a41
cmp dword [ebp - 0xf66c], ebx
jne 0x492a41
cmp dword [ebp - 0xf680], ebx
jne 0x492a41
cmp dword [ebp - 0xf640], ebx
jne 0x492a41
mov eax, dword [0x71de6c]
cmp dword [ebp - 0xf650], ebx
je 0x492a0c
cmp eax, ebx
je 0x4929f7
push ebx
push eax
push str.BLANKFILE____
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x1a
call fcn.004418a0
add esp, 4
mov dword [ebp - 0xf608], edi
jmp 0x49aafb
cmp eax, ebx
je 0x492a24
push ebx
push eax
push str.CLCache_Search
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [ebp - 0xf5f0]
lea edx, [ebp - 0xeb70]
push edx
push eax
push 0x7600b4
call fcn.00556910
add esp, 0xc
jmp 0x492a47
mov eax, dword [ebp - 0xf6a4]
cmp eax, 2
jne 0x492ab1
cmp esi, 0x19
jge 0x492a67
cmp esi, 4
jle 0x492ab1
mov ecx, esi
and ecx, 0x80000001
jns 0x492a65
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x492ab1
cmp dword [0x71de6c], ebx
je 0x492a9c
push esi
lea edx, [ebp - 0x7ccc]
push str.Present_In_CLCache__Also_SC___d_...
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x7ccc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x1a
call fcn.004418a0
add esp, 4
mov dword [ebp - 0xf608], edi
jmp 0x49aafb
cmp dword [0x71de6c], ebx
je 0x492b25
cmp eax, ebx
jne 0x492ac6
push esi
push ebx
push str.NOT_Present_In_CLCache__FAR___u__SC___u_...
jmp 0x492afb
cmp eax, edi
jne 0x492ada
push esi
push edi
push str.NOT_Present__Data_does_not_match__In_CLCache__FAR___u__SC___u_...
lea eax, [ebp - 0x2cf0]
push eax
jmp 0x492b02
cmp eax, 2
jne 0x492aef
push esi
push eax
push str.SC___25._Not_computing_FARes__FAR___u__SC___u_...
lea ecx, [ebp - 0x2cf0]
push ecx
jmp 0x492b02
cmp eax, 3
jne 0x492b0a
push esi
push eax
push str.NOT_Present__Incorrect_Params__In_CLCache__FAR___u__SC___u_...
lea edx, [ebp - 0x2cf0]
push edx
call fcn.005dfb23
add esp, 0x10
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x2cf0]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x1a
call fcn.004418a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, edi
cmp dword [ebp - 0xeb54], 0
jbe 0x492b7b
or eax, 0xffffffff
jmp 0x492b81
mov eax, dword [ebp - 0xeb50]
cmp dword [0x71de6c], 0
mov dword [ebp - 0xf5f8], eax
je 0x492bc6
mov edx, dword [ebp - 0xf5f0]
push eax
push edx
lea eax, [ebp - 0x13bc]
push str.File:__s_FileSize_:__d
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov ecx, dword [ebp - 0xf5f0]
cmp byte [ecx], 0x5c
jne 0x492c0a
cmp byte [ecx + 1], 0x5c
jne 0x492c0a
cmp dword [0x6e989c], esi
je 0x492ccd
mov eax, dword [0x71de6c]
test eax, eax
je 0x49aafb
push 0
push eax
push str.Exclude_Drive:_Not_Scanning_Network_Drives
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
xor eax, eax
push 2
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov byte [ebp - 0x23], al
push ecx
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], 0x12
mov byte [ebp - 0x2c], 0
call fcn.005e2f3c
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 0x2a], 0
call fcn.004e24e0
add esp, 0x10
lea edx, [ebp - 0x2c]
push edx
call fcn.004e9b10
cmp eax, 3
jne 0x492c79
cmp dword [0x6e9898], esi
je 0x492ccd
mov eax, dword [0x71de6c]
test eax, eax
je 0x49aafb
push 0
push eax
push str.Exclude_Drive:_Not_Scanning_Fixed_Drives
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
cmp eax, 2
jne 0x492ccd
cmp dword [0x6e9894], esi
je 0x492ccd
mov eax, dword [0x71de6c]
test eax, eax
je 0x49aafb
push 0
push eax
push str.Exclude_Drive:_Not_Scanning_Removable_Drives
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x37c]
push ecx
mov dword [ebp - 4], 0x14
call fcn.00454b00
add esp, 8
test eax, eax
je 0x492d52
mov eax, dword [0x71de6c]
test eax, eax
je 0x492d0c
push 0
push eax
push str.Previously_Renamed_File_Extention_Present._Skip_File_Scanning
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, 1
cmp dword [0x685b84], eax
jne 0x49aafb
mov dword [ebp - 0xf6d0], eax
mov dword [ebp - 0xf608], 0xd
jmp 0x49aafb
lea edx, [ebp - 0x37c]
push 0x61de18
push edx
mov dword [ebp - 4], 0x16
call fcn.005e324f
add esp, 8
test eax, eax
je 0x492e09
lea eax, [ebp - 0x37c]
push 0x61de14
push eax
call fcn.005e324f
add esp, 8
test eax, eax
je 0x492e09
lea ecx, [ebp - 0x37c]
push 0x61de10
push ecx
call fcn.005e324f
add esp, 8
test eax, eax
je 0x492e09
lea edx, [ebp - 0x37c]
push 0x61de0c
push edx
call fcn.005e324f
add esp, 8
test eax, eax
je 0x492e09
lea eax, [ebp - 0x37c]
push 0x61de08
push eax
call fcn.005e324f
add esp, 8
test eax, eax
je 0x492e09
lea ecx, [ebp - 0x37c]
push 0x61de04
push ecx
call fcn.005e324f
add esp, 8
test eax, eax
je 0x492e09
lea edx, [ebp - 0x37c]
push 0x61de00
push edx
call fcn.005e324f
add esp, 8
test eax, eax
jne 0x492f20
mov eax, dword [ebp - 0xf5f0]
push 0
push str.TrainF
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
mov ecx, dword [ebp - 0xf5f0]
push 0
push str.Quaran
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
mov edx, dword [ebp - 0xf5f0]
push 0
push str.Queue
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
mov eax, dword [ebp - 0xf5f0]
push 0
push str.TEMPMAI
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
mov ecx, dword [ebp - 0xf5f0]
push 0
push str.OUTCOP
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
mov edx, dword [ebp - 0xf5f0]
push 0
push str.OUTSMF
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
mov eax, dword [ebp - 0xf5f0]
push 0
push str.OUTSML
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
mov ecx, dword [ebp - 0xf5f0]
push 0
push str.TEMPJET
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
mov edx, dword [ebp - 0xf5f0]
push 0
push 0x61dda4
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x492fa1
lea eax, [ebp - 0x37c]
push 0x61dda0
push eax
call fcn.005e324f
add esp, 8
test eax, eax
jne 0x493008
mov ecx, dword [ebp - 0xf5f0]
push eax
push str.IN_
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x493008
cmp dword [0x71de6c], 0
je 0x49aafb
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0x13bc]
push str.File_Present_In_MWT_Exclude_Folders:__s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x49aafb
cmp dword [0x71de6c], 0
je 0x49aafb
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x13bc]
push str.File_Present_In_MWT_Exclude_Folders:__s
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x49aafb
cmp dword [0x71de6c], 0
mov edi, dword [ebp - 0xf630]
mov ebx, edi
mov dword [ebp - 4], 0x18
je 0x493054
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0x13bc]
push str.Point_X1X___s_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
lea edx, [ebp - 0x37c]
push edx
lea eax, [ebp - 0x2bec]
push eax
call fcn.0045e280
mov esi, eax
add esp, 8
cmp esi, 1
je 0x49aafb
xor ecx, ecx
cmp dword [ebp - 0xf670], 0xffffffff
mov dword [ebp - 0xf6ec], ecx
mov dword [ebp - 0xf5fc], ecx
jne 0x49325b
mov eax, dword [0x71de6c]
cmp eax, ecx
je 0x4930ad
push ecx
push eax
push str.IsItSpecF_c_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea ecx, [ebp - 0xf68c]
push ecx
lea edx, [ebp - 0xf650]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0xf684]
push eax
lea ecx, [ebp - 0xf6e8]
push ecx
push 0
lea edx, [ebp - 0xf64c]
push edx
lea eax, [ebp - 0xf618]
push eax
lea ecx, [ebp - 0xf654]
push ecx
mov ecx, dword [ebp - 0xf70c]
lea edx, [ebp - 0xf658]
push edx
mov edx, dword [ebp - 0xf6ac]
lea eax, [ebp - 0xf67c]
push eax
push ecx
push edx
mov edx, dword [ebp - 0xf714]
lea eax, [ebp - 0xf698]
push eax
lea ecx, [ebp - 0xf664]
push ecx
push edx
lea eax, [ebp - 0xf600]
push eax
mov eax, dword [ebp - 0xf5f4]
push 0
push 0
push 0
lea ecx, [ebp - 0xf634]
push ecx
mov ecx, dword [ebp - 0xf5f0]
lea edx, [ebp - 0x174]
push edx
push 0
push eax
push ecx
call fcn.004c1560
add esp, 0x6c
cmp dword [0x71de6c], 0
mov dword [ebp - 0xf670], eax
je 0x4931cd
mov eax, dword [ebp - 0xf650]
mov ecx, dword [ebp - 0xf64c]
lea edx, [ebp - 0x174]
push edx
mov edx, dword [ebp - 0xf618]
push eax
mov eax, dword [ebp - 0xf654]
push ecx
mov ecx, dword [ebp - 0xf658]
push edx
mov edx, dword [ebp - 0xf67c]
push eax
mov eax, dword [ebp - 0xf698]
push ecx
mov ecx, dword [ebp - 0xf600]
push edx
mov edx, dword [ebp - 0xf634]
push eax
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x40
cmp dword [ebp - 0xf6f4], 0
jne 0x4931e8
cmp dword [ebp - 0xf6bc], 0
je 0x49325b
cmp dword [ebp - 0xf618], 0
je 0x49325b
cmp dword [0x71de6c], 0
je 0x49321f
lea eax, [ebp - 0x13bc]
push str.Forcing_PopExt_to_SCRIPT_4_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov eax, dword [str.SCRIPT]
mov cx, word [0x630114]
mov dl, byte [0x630116]
mov dword [ebp - 0x174], eax
mov eax, 1
mov word [ebp - 0x170], cx
mov byte [ebp - 0x16e], dl
mov dword [ebp - 0xf654], eax
mov dword [ebp - 0xf600], eax
mov dword [ebp - 0xf658], eax
cmp dword [ebp - 0xf650], 0
je 0x4932e7
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49aafb
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov eax, dword [ebp - 0xf5f0]
push 1
push 0
push ebx
push eax
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x4932b6
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x49aafb
push 0
push eax
push str.Inserted_in_CacheTree_1g_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
cmp dword [ebp - 0xf600], 0
jne 0x493331
lea ecx, [ebp - 0x174]
push 0x63a37c
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493329
lea edx, [ebp - 0x174]
push 0x62835c
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493329
cmp dword [ebp - 0xf634], 0
je 0x49333e
test esi, esi
jne 0x49aafb
cmp dword [ebp - 0xf634], 0
jne 0x493696
push 3
lea eax, [ebp - 0x37c]
push 0x62835c
push eax
mov dword [ebp - 0xf62c], 0
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x493420
push 3
lea ecx, [ebp - 0x37c]
push 0x63a378
push ecx
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x493420
push 4
lea edx, [ebp - 0x37c]
push str.html
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x493420
push 4
lea eax, [ebp - 0x37c]
push str.aspx
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x493420
lea ecx, [ebp - 0x174]
push 0x63a364
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x493420
lea edx, [ebp - 0x174]
push 0x63a360
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493420
lea eax, [ebp - 0x174]
push 0x63a35c
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493420
lea ecx, [ebp - 0x174]
push str.SCRIPT
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x494d91
lea edx, [ebp - 0x37c]
push 0x63a358
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x494d91
lea eax, [ebp - 0x37c]
push 0x63a354
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x494d91
lea ecx, [ebp - 0x37c]
push 0x63a350
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x494d91
call fcn.004578c0
mov esi, dword [ebp - 0xf5f8]
shl eax, 0xa
cmp esi, eax
ja 0x49364c
cmp ebx, 0xffffffff
jne 0x4934b0
lea edx, [ebp - 0x37c]
push edx
call fcn.004af7d0
add esp, 4
test eax, eax
je 0x4934ac
mov ebx, 1
jmp 0x4935a3
xor ebx, ebx
jmp 0x4934b8
test ebx, ebx
jne 0x4935a3
cmp edi, 0xffffffff
jne 0x4935a3
mov esi, dword [ebp - 0xf60c]
lea eax, [ebp - 0x16c8]
push eax
push esi
call fcn.005414c0
add esp, 8
cmp eax, 2
jne 0x4935a1
cmp dword [0x71de6c], 0
je 0x493518
push esi
lea ecx, [ebp - 0x13bc]
push str.WHITE_LISTED_PID_1_:__u
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [ebp - 0x1cd0], 0
jne 0x493579
cmp esi, 4
jbe 0x493579
push 7
push 0x400
lea ecx, [ebp - 0x16c8]
push ecx
lea edx, [ebp - 0x1cd0]
push edx
push esi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x493579
lea eax, [ebp - 0x1cd0]
push 0x5c
push eax
call fcn.005e0a00
add esp, 8
test eax, eax
jne 0x493570
lea eax, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], eax
jmp 0x493583
inc eax
mov dword [ebp - 0xf604], eax
jmp 0x49357f
mov eax, dword [ebp - 0xf604]
test eax, eax
je 0x49359a
cmp byte [eax], 0
je 0x49359a
push str.bdc.exe
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x4935a1
mov edi, 1
jmp 0x4935a3
xor edi, edi
xor esi, esi
cmp dword [0x6e8ce0], esi
jne 0x494d91
cmp edi, esi
jne 0x4935f1
cmp ebx, esi
jne 0x4935f1
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x4935d6
push esi
push eax
push str.Forcing_ArchScan_1_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], 1
mov dword [ebp - 0xf638], esi
mov dword [ebp - 0xf62c], esi
jmp 0x494fd6
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x493635
cmp edi, 1
jne 0x493613
push esi
push eax
push str.NOT_Forcing_ArchScan_1__as_PID_Whitelisted
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x493635
cmp ebx, 1
jne 0x493635
push esi
push eax
push str.NOT_Forcing_ArchScan_1__as_ObjExtn_in_LibreList
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], esi
mov dword [ebp - 0xf638], esi
mov dword [ebp - 0xf62c], esi
jmp 0x494d9e
cmp dword [0x71de6c], 0
je 0x494d91
call fcn.004578c0
push eax
shr esi, 0xa
push esi
lea ecx, [ebp - 0x13bc]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_1_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x494d91
cmp dword [0x6e8ce0], 0
mov dword [ebp - 0xf62c], 1
jne 0x494d91
push 5
lea ecx, [ebp - 0x2bec]
push str.eicar
push ecx
call fcn.004dd670
xor esi, esi
add esp, 0xc
cmp eax, esi
je 0x493789
push 3
lea edx, [ebp - 0x37c]
push 0x62835c
push edx
call fcn.004dd670
add esp, 0xc
cmp eax, esi
je 0x493789
push 3
lea eax, [ebp - 0x37c]
push 0x63a378
push eax
call fcn.004dd670
add esp, 0xc
cmp eax, esi
je 0x493789
push 4
lea ecx, [ebp - 0x37c]
push str.html
push ecx
call fcn.004dd670
add esp, 0xc
cmp eax, esi
je 0x493789
push 4
lea edx, [ebp - 0x37c]
push str.aspx
push edx
call fcn.004dd670
add esp, 0xc
cmp eax, esi
je 0x493789
lea eax, [ebp - 0x174]
push 0x63a360
push eax
call fcn.004dd620
add esp, 8
cmp eax, esi
je 0x493789
lea ecx, [ebp - 0x174]
push 0x63a35c
push ecx
call fcn.004dd620
add esp, 8
cmp eax, esi
je 0x493789
lea edx, [ebp - 0x174]
push str.SCRIPT
push edx
call fcn.004dd620
add esp, 8
cmp eax, esi
jne 0x4939ae
call fcn.004578c0
shl eax, 0xa
cmp dword [ebp - 0xf5f8], eax
ja 0x493969
cmp ebx, 0xffffffff
jne 0x4937cf
lea eax, [ebp - 0x37c]
push eax
call fcn.004af7d0
add esp, 4
cmp eax, esi
je 0x4937c5
mov ebx, 1
mov dword [ebp - 0xf610], ebx
jmp 0x4938c5
xor ebx, ebx
mov dword [ebp - 0xf610], ebx
jmp 0x4937d7
cmp ebx, esi
jne 0x4938c5
cmp edi, 0xffffffff
jne 0x4938c5
mov edi, dword [ebp - 0xf60c]
lea ecx, [ebp - 0x16c8]
push ecx
push edi
call fcn.005414c0
add esp, 8
cmp eax, 2
jne 0x4938bd
cmp dword [0x71de6c], esi
je 0x493834
push edi
lea edx, [ebp - 0x13bc]
push str.WHITE_LISTED_PID_2_:__u
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push esi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [ebp - 0x1cd0], 0
jne 0x493895
cmp edi, 4
jbe 0x493895
push 8
push 0x400
lea edx, [ebp - 0x16c8]
push edx
lea eax, [ebp - 0x1cd0]
push eax
push edi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x493895
lea ecx, [ebp - 0x1cd0]
push 0x5c
push ecx
call fcn.005e0a00
add esp, 8
cmp eax, esi
jne 0x49388c
lea eax, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], eax
jmp 0x49389f
inc eax
mov dword [ebp - 0xf604], eax
jmp 0x49389b
mov eax, dword [ebp - 0xf604]
cmp eax, esi
je 0x4938b6
cmp byte [eax], 0
je 0x4938b6
push str.bdc.exe
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x4938bd
mov edi, 1
jmp 0x4938bf
xor edi, edi
mov dword [ebp - 0xf630], edi
cmp dword [0x6e8ce0], esi
jne 0x4939ae
cmp edi, esi
jne 0x493911
cmp ebx, esi
jne 0x493911
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x4938f6
push esi
push eax
push str.Forcing_ArchScan_2_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], 1
mov dword [ebp - 0xf638], esi
mov dword [ebp - 0xf62c], esi
jmp 0x4939ae
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x493955
cmp edi, 1
jne 0x493933
push esi
push eax
push str.NOT_Forcing_ArchScan_2__as_PID_Whitelisted
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x493955
cmp ebx, 1
jne 0x493955
push esi
push eax
push str.NOT_Forcing_ArchScan_2__as_ObjExtn_in_LibreList
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], esi
mov dword [ebp - 0xf638], esi
mov dword [ebp - 0xf62c], esi
jmp 0x4939ae
cmp dword [0x71de6c], esi
je 0x4939ae
call fcn.004578c0
mov edx, dword [ebp - 0xf5f8]
push eax
shr edx, 0xa
push edx
lea eax, [ebp - 0x13bc]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_2_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push esi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov eax, dword [ebp - 0xf5f0]
cmp byte [eax], 0x5c
jne 0x4939c5
cmp byte [eax + 1], 0x5c
je 0x494acd
xor esi, esi
mov eax, dword [ebp - 0xf5f8]
fild dword [ebp - 0xf5f8]
mov dword [ebp - 0xf648], esi
test eax, eax
jge 0x4939e1
fadd qword [0x60ecc0]
fst qword [ebp - 0xf6a0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 5
jnp 0x493a29
lea ecx, [ebp - 0x174]
push 0x63aab8
push ecx
call fcn.004dd620
add esp, 8
cmp eax, esi
jne 0x493ced
fld qword [0x63aab0]
fcomp qword [ebp - 0xf6a0]
fnstsw ax
test ah, 0x41
jne 0x493ced
xor esi, esi
lea edx, [ebp - 0x174]
push 0x63aaa8
push edx
call fcn.004dd620
add esp, 8
cmp eax, esi
je 0x493a75
lea eax, [ebp - 0x174]
push 0x63aaa4
push eax
call fcn.004dd620
add esp, 8
cmp eax, esi
je 0x493a75
lea ecx, [ebp - 0x174]
push 0x63aab8
push ecx
call fcn.004dd620
add esp, 8
cmp eax, esi
jne 0x493b07
push esi
lea edx, [ebp - 0x2bec]
push str.xlsx.
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x493ad7
push esi
lea eax, [ebp - 0x2bec]
push str.docx.
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x493ad7
push esi
lea ecx, [ebp - 0x2bec]
push str.pdf.
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x493ad7
lea edx, [ebp - 0x2bec]
push esi
push edx
call fcn.004ad650
add esp, 8
cmp eax, esi
je 0x493b07
mov eax, dword [0x71de6c]
mov dword [ebp - 0xf648], 1
cmp eax, esi
je 0x493d43
push esi
push eax
push str.ForceScanArj_set__F_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x493ced
lea eax, [ebp - 0x174]
push 0x63aaa8
push eax
call fcn.004dd620
add esp, 8
cmp eax, esi
jne 0x493b6b
mov ecx, dword [ebp - 0xf5f8]
mov edx, dword [ebp - 0xf5f4]
push ecx
push edx
push esi
push esi
call fcn.004aa3c0
add esp, 0x10
cmp eax, esi
je 0x493b6b
mov eax, dword [0x71de6c]
mov dword [ebp - 0xf648], 1
cmp eax, esi
je 0x493d43
push esi
push eax
push str.ForceScanArj_set__G_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x493ced
lea eax, [ebp - 0x174]
push 0x63aab8
push eax
call fcn.004dd620
add esp, 8
cmp eax, esi
jne 0x493ced
mov edi, dword [ebp - 0xf5f8]
add edi, 0x401
push edi
mov dword [ebp - 0xf7e8], 0
call fcn.005e20e4
mov esi, eax
add esp, 4
test esi, esi
je 0x493ced
mov ecx, dword [ebp - 0xf5f4]
push ecx
xor ebx, ebx
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x493bd8
mov edx, dword [ebp - 0xf5f4]
push 1
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
push edi
push 0
push esi
call fcn.005dfd60
mov ecx, dword [ebp - 0xf5f8]
mov edx, dword [ebp - 0xf5f4]
add esp, 0xc
push 0
lea eax, [ebp - 0xf7e8]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x493cc2
cmp dword [ebp - 0xf7e8], 0x8010
jbe 0x493cc2
mov al, byte [esi + 0x8000]
cmp al, 1
jne 0x493c5c
cmp byte [esi + 0x8001], 0x43
jne 0x493c5c
cmp byte [esi + 0x8002], 0x44
jne 0x493c5c
cmp byte [esi + 0x8006], al
jne 0x493c5c
mov eax, dword [0x71de6c]
mov edi, 1
mov dword [ebp - 0xf648], edi
test eax, eax
je 0x493ca4
push 0
push eax
push str.ForceScanArj_set__H_
jmp 0x493c97
test al, al
jne 0x493cc2
cmp byte [esi + 0x8001], 0x42
jne 0x493cc2
cmp byte [esi + 0x8002], 0x45
jne 0x493cc2
cmp byte [esi + 0x8006], 1
jne 0x493cc2
mov eax, dword [0x71de6c]
mov edi, 1
mov dword [ebp - 0xf648], edi
test eax, eax
je 0x493ca4
push 0
push eax
push str.ForceScanArj_set__I_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea eax, [esi + 0x8008]
push str.Win32
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x493cc2
mov dword [ebp - 0xf6dc], edi
push esi
call fcn.005e0865
mov ecx, dword [ebp - 0xf5f4]
push ecx
call fcn.004d90d0
add esp, 8
test eax, eax
je 0x493ced
mov edx, dword [ebp - 0xf5f4]
push 0
push 0
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x71de6c], 0
je 0x493d43
mov edx, dword [ebp - 0xf62c]
lea eax, [ebp - 0x174]
push eax
mov eax, dword [ebp - 0xf5f8]
cmp eax, 0x600000
sbb ecx, ecx
neg ecx
push ecx
push eax
push edx
lea eax, [ebp - 0x13bc]
push str.bArch_u__dwObjSize_u___u___PopExt__s_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
cmp dword [ebp - 0xf62c], 0
je 0x494d85
fld qword [str.ffffffVAxlt]
fcomp qword [ebp - 0xf6a0]
fnstsw ax
test ah, 0x41
je 0x493d96
lea eax, [ebp - 0x174]
push 0x63aab8
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x494acd
fld qword [0x63aab0]
fcomp qword [ebp - 0xf6a0]
fnstsw ax
test ah, 0x41
jne 0x494acd
lea ecx, [ebp - 0x174]
push 0x62f418
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493e86
lea edx, [ebp - 0x174]
push edx
call fcn.004e3fc0
add esp, 4
test eax, eax
jne 0x493e86
lea eax, [ebp - 0x174]
push 0x63b0d8
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493e86
lea ecx, [ebp - 0x174]
push 0x63b0d4
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493e86
lea edx, [ebp - 0x174]
push 0x63a104
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493e86
lea eax, [ebp - 0x174]
push 0x63ab8c
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493e86
lea ecx, [ebp - 0x174]
push 0x63ab94
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493e86
lea edx, [ebp - 0x174]
push 0x63ab90
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493e86
lea eax, [ebp - 0x174]
push 0x63aaa8
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x493e86
cmp dword [ebp - 0xf648], 0
je 0x494acd
lea ecx, [ebp - 0x174]
push 0x62f418
xor edi, edi
push ecx
mov dword [ebp - 0xf63c], edi
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x4940df
lea edx, [ebp - 0xf678]
push edx
mov edx, dword [ebp - 0xf5f4]
lea eax, [ebp - 0xf63c]
push eax
push edi
push edi
lea ecx, [ebp - 0xf780]
push ecx
mov ecx, dword [ebp - 0xf5f0]
push edx
push edi
lea eax, [ebp - 0xf6ec]
push eax
push ecx
mov dword [ebp - 0xf780], edi
call fcn.004b8f20
add esp, 0x24
mov esi, eax
mov dword [ebp - 0xf5fc], esi
cmp dword [0x71de6c], edi
je 0x493f46
mov edx, dword [ebp - 0xf678]
mov eax, dword [ebp - 0xf68c]
mov ecx, dword [ebp - 0xf63c]
push edx
mov edx, dword [ebp - 0xf780]
push eax
mov eax, dword [ebp - 0xf6ec]
push ecx
push edx
push eax
push esi
lea ecx, [ebp - 0x13bc]
push str.ZC_2____d_PwdProt___d__PIFSCR___u__OneExe___u__FFExe___u__TDoc___u
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push edi
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x30
cmp esi, 0xffffffff
jne 0x493f73
cmp dword [ebp - 0xf68c], 0
je 0x493f73
mov edi, 1
mov esi, edi
mov dword [ebp - 0xf5fc], esi
mov dword [ebp - 0xf63c], edi
mov dword [ebp - 0xf6ec], 0
jmp 0x493f78
mov edi, 1
cmp dword [ebp - 0xf780], 0
je 0x494062
cmp dword [0x71de6c], 0
je 0x493fd1
mov ecx, dword [ebp - 0xf5f8]
mov edx, dword [0x6861c4]
mov eax, dword [ebp - 0xf694]
push ecx
push edx
push eax
lea ecx, [ebp - 0x13bc]
push str.EMC_4____u_BlockSus___u__dwObjSize___u
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp dword [ebp - 0xf694], 0
je 0x494047
cmp dword [0x6861c4], 0
je 0x494047
fld qword [str.ffffffVAxlt]
fcomp qword [ebp - 0xf6a0]
fnstsw ax
test ah, 0x41
jne 0x494047
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0x13bc]
push str.Suspicious_Attachment:_s____BLOCKING_1_
push edx
call fcn.005dfb23
push 0
push edi
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0xf640], edi
cmp dword [ebp - 0xf63c], 0
jne 0x4942f7
mov dword [ebp - 0xf5fc], 0
jmp 0x494acd
cmp esi, edi
jne 0x49402b
mov dword [ebp - 0xf61c], edi
mov dword [ebp - 0xf5fc], edi
mov dword [ebp - 0xf63c], edi
jmp 0x494309
cmp esi, edi
je 0x49406b
cmp esi, 0xffffffff
jne 0x49402b
cmp dword [ebp - 0xf6ec], 0
je 0x49407d
cmp byte [0x72bba0], 0
je 0x49402b
lea ecx, [ebp - 0x2bec]
push 0
push ecx
call fcn.004ad650
add esp, 8
test eax, eax
je 0x49402b
cmp dword [0x71de6c], 0
je 0x4940c8
lea edx, [ebp - 0x13bc]
push str.ZC_1B____Reserved_Name_in_Zip___Setting_infected
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov dword [ebp - 0xf61c], edi
mov dword [ebp - 0xf5fc], edi
mov dword [ebp - 0xf63c], edi
jmp 0x494309
lea edx, [ebp - 0x174]
push 0x634a04
push edx
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x4947e5
lea eax, [ebp - 0x174]
push 0x63abc4
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
je 0x4947e5
lea ecx, [ebp - 0x174]
push 0x63ab94
push ecx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x49415d
mov edx, dword [ebp - 0xf5f4]
push edi
push edx
call fcn.004aa630
add esp, 8
cmp eax, edi
je 0x494acd
mov edi, 1
mov dword [ebp - 0xf5fc], edi
mov dword [ebp - 0xf61c], edi
jmp 0x494309
cmp dword [ebp - 0xf634], edi
je 0x49418e
lea eax, [ebp - 0x174]
push 0x63ab90
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x49418e
mov ecx, dword [ebp - 0xf5f0]
push ecx
call fcn.0045e540
add esp, 4
jmp 0x49413f
lea edx, [ebp - 0x174]
push 0x63ab8c
push edx
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x4943a9
cmp dword [0x71de6c], edi
je 0x4941ec
mov eax, dword [ebp - 0xf5f8]
mov ecx, dword [ebp - 0xf668]
push eax
push ecx
lea edx, [ebp - 0x13bc]
push str.ISP_ARCH_C1_:_FBS_u__dwObjSize_u
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp dword [ebp - 0xf668], edi
jne 0x494371
xor edi, edi
push 0x103
lea edx, [ebp - 0x390f]
push edi
push edx
mov dword [ebp - 0xf760], edi
mov byte [ebp - 0x3910], 0
call fcn.005dfd60
add esp, 0xc
xor esi, esi
mov dword [ebp - 0xf7f0], edi
call fcn.004d96c0
cmp eax, edi
je 0x49423e
lea eax, [ebp - 0xf7f0]
push eax
call fcn.004f77e0
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x3910]
push ecx
mov ecx, dword [ebp - 0xf5f0]
lea edx, [ebp - 0xf760]
push edx
lea eax, [ebp - 0xf63c]
push eax
push ecx
call fcn.004c1210
add esp, 0x10
cmp eax, edi
je 0x494289
cmp dword [ebp - 0xf63c], edi
je 0x494289
cmp dword [ebp - 0xf760], edi
jne 0x494289
mov eax, 1
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
jmp 0x4942e4
cmp byte [ebp - 0x3910], 0
je 0x4942e4
cmp dword [ebp - 0xf760], edi
jne 0x4942b5
cmp dword [ebp - 0xf68c], edi
je 0x4942b5
mov eax, 1
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
jmp 0x4942e4
lea edx, [ebp - 0x3910]
push edx
lea eax, [ebp - 0x13bc]
push str._ACE__ErMsg2:_s
push eax
call fcn.005dfb23
push edi
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp esi, edi
je 0x4942f7
mov edx, dword [ebp - 0xf7f0]
push edx
call fcn.004f7860
add esp, 4
cmp dword [ebp - 0xf5fc], 1
jne 0x494acd
mov edi, 1
cmp dword [ebp - 0xf6ec], 0
je 0x494324
cmp byte [0x72bba0], 0
je 0x494acd
mov edi, 1
mov dword [ebp - 0xf61c], edi
call fcn.004578c0
shl eax, 0xa
cmp dword [ebp - 0xf5f8], eax
ja 0x494a86
mov eax, dword [ebp - 0xf610]
cmp eax, 0xffffffff
jne 0x4948e4
lea eax, [ebp - 0x37c]
push eax
call fcn.004af7d0
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x4948dc
mov dword [ebp - 0xf610], edi
jmp 0x4949e0
mov eax, dword [ebp - 0xf5f8]
cmp eax, 0x190
jae 0x494390
push eax
mov eax, dword [ebp - 0xf5f4]
push eax
call fcn.004aa520
jmp 0x49413c
mov dword [ebp - 0xf724], 1
mov dword [ebp - 0xf5fc], 0xffffffff
jmp 0x494acd
lea ecx, [ebp - 0x174]
push ecx
call fcn.004e3fc0
add esp, 4
cmp eax, edi
je 0x494577
push 0x103
lea edx, [ebp - 0x22e7]
push edi
push edx
mov byte [ebp - 0x22e8], 0
call fcn.005dfd60
mov al, byte [ebp - 0x173]
sub al, 0x30
add esp, 0xc
mov ebx, 1
cmp al, 2
ja 0x4943ef
mov edi, ebx
cmp dword [ebp - 0xf668], 0
push 0
push 0
push 0
je 0x4944b9
mov eax, dword [ebp - 0xf5f4]
lea ecx, [ebp - 0xf63c]
push ecx
mov ecx, dword [ebp - 0xf620]
lea edx, [ebp - 0x22e8]
push edx
push 2
push eax
push ecx
push 0
call fcn.004bc390
add esp, 0x24
cmp dword [0x71de6c], 0
mov esi, eax
je 0x494472
mov eax, dword [ebp - 0xf63c]
lea edx, [ebp - 0x22e8]
push edx
push eax
push esi
lea ecx, [ebp - 0x13bc]
push str.ISP_ARCH_D_:_rv_u__OneExe_u__ErMsg:_s_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
test esi, esi
je 0x494483
cmp dword [ebp - 0xf63c], 0
jne 0x4944e7
test edi, edi
jne 0x4944e7
cmp byte [ebp - 0x22e8], 0
je 0x4944f3
push 0
lea ecx, [ebp - 0x22e8]
push str.7z_Error
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4944f3
mov dword [ebp - 0xf724], ebx
mov dword [ebp - 0xf5fc], 0xffffffff
jmp 0x4944f3
mov ecx, dword [ebp - 0xf620]
push 0
lea edx, [ebp - 0xf63c]
push edx
lea eax, [ebp - 0x22e8]
push eax
push ecx
push 0
call fcn.004ba3d0
add esp, 0x20
test eax, eax
je 0x4944f3
cmp dword [ebp - 0xf63c], 0
je 0x4944f3
mov dword [ebp - 0xf5fc], ebx
mov dword [ebp - 0xf61c], ebx
cmp dword [0x71de6c], 0
je 0x4942f7
cmp dword [ebp - 0xf668], 0
je 0x49452c
mov edx, dword [ebp - 0xf63c]
mov eax, dword [ebp - 0xf6ec]
mov ecx, dword [ebp - 0xf5fc]
push edx
push eax
push ecx
push str.ZC_2aS____d__PwdProt___d__OneExe_d
lea edx, [ebp - 0x13bc]
push edx
jmp 0x49454d
mov eax, dword [ebp - 0xf63c]
mov ecx, dword [ebp - 0xf6ec]
mov edx, dword [ebp - 0xf5fc]
push eax
push ecx
push edx
push str.ZC_2aN____d__PwdProt___d__OneExe_d
lea eax, [ebp - 0x13bc]
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x4942f7
lea eax, [ebp - 0x174]
push 0x63b0d8
push eax
call fcn.004dd620
add esp, 8
cmp eax, edi
jne 0x49475a
mov ecx, dword [ebp - 0xf5f4]
push ecx
call fcn.004d90d0
add esp, 4
mov ebx, 1
test eax, eax
je 0x4945bf
mov edx, dword [ebp - 0xf5f4]
push ebx
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
mov eax, dword [ebp - 0xf5f4]
mov ecx, dword [ebp - 0xf5f0]
push eax
push ecx
call fcn.004a93d0
add esp, 8
cmp dword [0x71de6c], 0
mov esi, eax
je 0x49460e
push esi
lea edx, [ebp - 0x13bc]
push str.CAB_B____d
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp esi, ebx
jne 0x49472c
push 0x207
lea edx, [ebp - 0x6e93]
push 0
push edx
mov byte [ebp - 0x6e94], 0
call fcn.005dfd60
mov eax, dword [ebp - 0xf5f4]
mov edx, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x6e94]
push ecx
push edx
call fcn.004a9680
add esp, 0x18
cmp byte [ebp - 0x6e94], 0
je 0x49472c
mov esi, dword [ebp - 0xf5f8]
push 0
lea eax, [ebp - 0x6e94]
push esi
push eax
call fcn.004b0510
add esp, 0xc
test eax, eax
je 0x49472c
cmp dword [0x71de6c], 0
mov dword [ebp - 0xf63c], ebx
mov dword [ebp - 0xf5fc], ebx
mov dword [ebp - 0xf61c], ebx
je 0x4946d2
mov ecx, dword [0x6861c4]
mov edx, dword [ebp - 0xf694]
push esi
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str.EMC_5____u_BlockSus___u__dwObjSize___u
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp dword [ebp - 0xf694], 0
je 0x49472c
cmp dword [0x6861c4], 0
je 0x49472c
fld qword [str.ffffffVAxlt]
fcomp qword [ebp - 0xf6a0]
fnstsw ax
test ah, 0x41
jne 0x49472c
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x13bc]
push str.Suspicious_Attachment:_s____BLOCKING_1a_
push ecx
call fcn.005dfb23
push 0
push ebx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0xf640], ebx
mov eax, dword [ebp - 0xf5f4]
push eax
call fcn.004d90d0
add esp, 4
test eax, eax
je 0x4942f7
mov ecx, dword [ebp - 0xf5f4]
push 0
push 0
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4942f7
mov eax, dword [ebp - 0xf5f8]
cmp eax, 0x190
jae 0x49479b
mov edx, dword [ebp - 0xf5f4]
push eax
push edx
call fcn.004aa520
add esp, 8
cmp eax, edi
je 0x494acd
mov edi, 1
mov dword [ebp - 0xf600], edi
mov dword [ebp - 0xf5fc], edi
mov dword [ebp - 0xf61c], edi
jmp 0x494309
cmp dword [ebp - 0xf648], edi
je 0x494acd
mov eax, dword [0x71de6c]
mov edi, 1
mov dword [ebp - 0xf600], edi
mov dword [ebp - 0xf5fc], edi
mov dword [ebp - 0xf61c], edi
test eax, eax
je 0x494309
push 0
push eax
push str.ForceScanArj_set__FINAL_F_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x494309
push 0x103
lea eax, [ebp - 0x4b47]
push edi
push eax
mov byte [ebp - 0x4b48], 0
call fcn.005dfd60
lea ecx, [ebp - 0x174]
push 0x634a04
push ecx
call fcn.004dd620
add esp, 0x14
xor edx, edx
push 0
test eax, eax
push 0
setne dl
push 0
lea eax, [ebp - 0xf63c]
push eax
mov eax, dword [ebp - 0xf620]
lea ecx, [ebp - 0x4b48]
push ecx
mov edi, edx
mov edx, dword [ebp - 0xf5f4]
push edi
push edx
push eax
push 0
call fcn.004bc390
add esp, 0x24
cmp dword [0x71de6c], 0
mov esi, eax
je 0x494890
mov edx, dword [ebp - 0xf63c]
lea ecx, [ebp - 0x4b48]
push ecx
push edx
push esi
lea eax, [ebp - 0x13bc]
push str.ISP_ARCH_C_:_rv_u__OneExe_u__ErMsg:_s_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
test esi, esi
je 0x494acd
cmp dword [ebp - 0xf63c], 0
jne 0x4948c4
cmp dword [0x730094], 0
je 0x494acd
cmp byte [ebp - 0x37c], 0
jne 0x494acd
cmp edi, 1
jne 0x494acd
mov eax, 1
mov dword [ebp - 0xf5fc], eax
mov dword [ebp - 0xf61c], eax
mov edi, eax
jmp 0x494309
mov dword [ebp - 0xf610], ebx
jmp 0x4948ee
xor ebx, ebx
cmp eax, ebx
jne 0x4949e0
cmp dword [ebp - 0xf630], 0xffffffff
jne 0x4949e0
mov esi, dword [ebp - 0xf60c]
lea ecx, [ebp - 0x16c8]
push ecx
push esi
call fcn.005414c0
add esp, 8
cmp eax, 2
jne 0x4949da
cmp dword [0x71de6c], ebx
je 0x49494f
push esi
lea edx, [ebp - 0x13bc]
push str.WHITE_LISTED_PID_4_:__u
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [ebp - 0x1cd0], 0
jne 0x4949b1
cmp esi, 4
jbe 0x4949b1
push 9
push 0x400
lea edx, [ebp - 0x16c8]
push edx
lea eax, [ebp - 0x1cd0]
push eax
push esi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x4949b1
lea ecx, [ebp - 0x1cd0]
push 0x5c
push ecx
call fcn.005e0a00
add esp, 8
cmp eax, ebx
jne 0x4949a7
lea eax, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], eax
jmp 0x4949bb
add eax, edi
mov dword [ebp - 0xf604], eax
jmp 0x4949b7
mov eax, dword [ebp - 0xf604]
cmp eax, ebx
je 0x4949d2
cmp byte [eax], 0
je 0x4949d2
push str.bdc.exe
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x4949da
mov dword [ebp - 0xf630], edi
jmp 0x4949e0
mov dword [ebp - 0xf630], ebx
cmp dword [0x6e8ce0], ebx
jne 0x494acd
mov edi, dword [ebp - 0xf630]
mov ebx, dword [ebp - 0xf610]
xor esi, esi
cmp edi, esi
jne 0x494a3e
cmp ebx, esi
jne 0x494a3e
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x4935d6
push esi
push eax
push str.Forcing_ArchScan_3_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], 1
mov dword [ebp - 0xf638], esi
mov dword [ebp - 0xf62c], esi
jmp 0x494fd6
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x493635
cmp edi, 1
jne 0x494a64
push esi
push eax
push str.NOT_Forcing_ArchScan_3__as_PID_Whitelisted
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x493635
cmp ebx, 1
jne 0x493635
push esi
push eax
push str.NOT_Forcing_ArchScan_3__as_ObjExtn_in_LibreList
jmp 0x493628
cmp dword [0x71de6c], 0
je 0x494acd
call fcn.004578c0
mov edx, dword [ebp - 0xf5f8]
push eax
shr edx, 0xa
push edx
lea eax, [ebp - 0x13bc]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_3_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp dword [ebp - 0xf62c], 0
je 0x494d85
lea eax, [ebp - 0x174]
push str.Encoded_VBS
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x494b3e
lea ecx, [ebp - 0x174]
push str.EXE_XORCrypt
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x494b3e
lea edx, [ebp - 0x174]
push str.EXE_EncPk
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x494b3e
lea eax, [ebp - 0x174]
push 0x639dc8
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x494d85
call fcn.004578c0
mov esi, dword [ebp - 0xf5f8]
shl eax, 0xa
cmp esi, eax
ja 0x494d44
mov edi, dword [ebp - 0xf610]
cmp edi, 0xffffffff
jne 0x494b8e
lea ecx, [ebp - 0x37c]
push ecx
call fcn.004af7d0
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x494b84
mov edi, 1
mov dword [ebp - 0xf610], edi
jmp 0x494c8e
xor edi, edi
mov dword [ebp - 0xf610], edi
jmp 0x494b98
xor ebx, ebx
test edi, edi
jne 0x494c8e
cmp dword [ebp - 0xf630], 0xffffffff
jne 0x494c8e
mov esi, dword [ebp - 0xf60c]
lea edx, [ebp - 0x16c8]
push edx
push esi
call fcn.005414c0
add esp, 8
cmp eax, 2
jne 0x494c88
cmp dword [0x71de6c], ebx
je 0x494bfa
push esi
lea eax, [ebp - 0x13bc]
push str.WHITE_LISTED_PID_5_:__u
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push ebx
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [ebp - 0x1cd0], 0
jne 0x494c5b
cmp esi, 4
jbe 0x494c5b
push 0xa
push 0x400
lea eax, [ebp - 0x16c8]
push eax
lea ecx, [ebp - 0x1cd0]
push ecx
push esi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x494c5b
lea edx, [ebp - 0x1cd0]
push 0x5c
push edx
call fcn.005e0a00
add esp, 8
cmp eax, ebx
jne 0x494c52
lea eax, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], eax
jmp 0x494c65
inc eax
mov dword [ebp - 0xf604], eax
jmp 0x494c61
mov eax, dword [ebp - 0xf604]
cmp eax, ebx
je 0x494c7c
cmp byte [eax], 0
je 0x494c7c
push str.bdc.exe
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x494c88
mov dword [ebp - 0xf630], 1
jmp 0x494c8e
mov dword [ebp - 0xf630], ebx
cmp dword [0x6e8ce0], ebx
jne 0x494d85
mov ecx, dword [ebp - 0xf630]
cmp ecx, ebx
jne 0x494ce0
cmp edi, ebx
jne 0x494ce0
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x494cc5
push ebx
push eax
push str.Forcing_ArchScan_4_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], 1
mov dword [ebp - 0xf638], ebx
mov dword [ebp - 0xf62c], ebx
jmp 0x494fd6
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x494d24
cmp ecx, 1
jne 0x494d02
push ebx
push eax
push str.NOT_Forcing_ArchScan_4__as_PID_Whitelisted
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x71de6c]
cmp eax, ebx
je 0x494d24
cmp edi, 1
jne 0x494d24
push ebx
push eax
push str.NOT_Forcing_ArchScan_4__as_ObjExtn_in_LibreList
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov edi, dword [ebp - 0xf630]
mov dword [ebp - 0xf624], ebx
mov dword [ebp - 0xf638], ebx
mov dword [ebp - 0xf62c], ebx
mov ebx, dword [ebp - 0xf610]
jmp 0x494d9e
cmp dword [0x71de6c], 0
je 0x494d85
call fcn.004578c0
push eax
shr esi, 0xa
push esi
lea eax, [ebp - 0x13bc]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_4_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov ebx, dword [ebp - 0xf610]
mov edi, dword [ebp - 0xf630]
cmp dword [ebp - 0xf624], 0
jne 0x494fd6
push 5
lea eax, [ebp - 0x2bec]
push str.eicar
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x494fd6
call fcn.004578c0
mov esi, dword [ebp - 0xf5f8]
shl eax, 0xa
cmp esi, eax
ja 0x494f95
cmp ebx, 0xffffffff
jne 0x494df8
lea ecx, [ebp - 0x37c]
push ecx
call fcn.004af7d0
add esp, 4
test eax, eax
je 0x494df4
mov ebx, 1
jmp 0x494eeb
xor ebx, ebx
jmp 0x494e00
test ebx, ebx
jne 0x494eeb
cmp edi, 0xffffffff
jne 0x494eeb
mov esi, dword [ebp - 0xf60c]
lea edx, [ebp - 0x16c8]
push edx
push esi
call fcn.005414c0
add esp, 8
cmp eax, 2
jne 0x494ee9
cmp dword [0x71de6c], 0
je 0x494e60
push esi
lea eax, [ebp - 0x13bc]
push str.WHITE_LISTED_PID_6_:__u
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [ebp - 0x1cd0], 0
jne 0x494ec1
cmp esi, 4
jbe 0x494ec1
push 0xb
push 0x400
lea eax, [ebp - 0x16c8]
push eax
lea ecx, [ebp - 0x1cd0]
push ecx
push esi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x1cd0], 0
je 0x494ec1
lea edx, [ebp - 0x1cd0]
push 0x5c
push edx
call fcn.005e0a00
add esp, 8
test eax, eax
jne 0x494eb8
lea eax, [ebp - 0x1cd0]
mov dword [ebp - 0xf604], eax
jmp 0x494ecb
inc eax
mov dword [ebp - 0xf604], eax
jmp 0x494ec7
mov eax, dword [ebp - 0xf604]
test eax, eax
je 0x494ee2
cmp byte [eax], 0
je 0x494ee2
push str.bdc.exe
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x494ee9
mov edi, 1
jmp 0x494eeb
xor edi, edi
xor esi, esi
cmp dword [0x6e8ce0], esi
jne 0x494fd6
cmp edi, esi
jne 0x494f3d
cmp ebx, esi
jne 0x494f3d
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x4935d6
push esi
push eax
push str.Forcing_ArchScan_5_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], 1
mov dword [ebp - 0xf638], esi
mov dword [ebp - 0xf62c], esi
jmp 0x494fd6
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x494f81
cmp edi, 1
jne 0x494f5f
push esi
push eax
push str.NOT_Forcing_ArchScan_5__as_PID_Whitelisted
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x494f81
cmp ebx, 1
jne 0x494f81
push esi
push eax
push str.NOT_Forcing_ArchScan_5__as_ObjExtn_in_LibreList
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf624], esi
mov dword [ebp - 0xf638], esi
mov dword [ebp - 0xf62c], esi
jmp 0x494fd6
cmp dword [0x71de6c], 0
je 0x494fd6
call fcn.004578c0
push eax
shr esi, 0xa
push esi
lea eax, [ebp - 0x13bc]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.__Not_Forcing_ArchScan_5_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp dword [ebp - 0xf5f8], 0xffffffff
jne 0x495080
mov eax, dword [0x71de6c]
test eax, eax
je 0x495001
push 0
push eax
push str.Skipping_Scan__FSize___1_...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49aafb
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov eax, dword [ebp - 0xf5f0]
push 1
push 0
push ebx
push eax
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x49504f
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x49aafb
push 0
push eax
push str.Inserted_in_CacheTree_1h_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
mov esi, dword [ebp - 0xf614]
cmp dword [esi*4 + 0x71de80], 0
je 0x4951d9
mov eax, dword [ebp - 0xf678]
cmp eax, 0x379
je 0x4950b1
cmp eax, 0x1bd
je 0x4950b1
cmp dword [ebp - 0xf6dc], 0
je 0x4950c7
cmp dword [ebp - 0xf624], 0
mov edi, 1
je 0x4950cc
mov dword [ebp - 0xf638], edi
jmp 0x4950cc
mov edi, 1
cmp dword [ebp - 0xf624], edi
jne 0x4951d9
mov ecx, dword [ebp - 0xf5f8]
fild dword [ebp - 0xf5f8]
test ecx, ecx
jge 0x4950ee
fadd qword [0x60ecc0]
fcomp qword [str.ffffffVAxlt]
fnstsw ax
test ah, 0x41
jp 0x495114
cmp dword [ebp - 0xf61c], edi
jne 0x495114
cmp dword [0x71de6c], 0
je 0x49514b
push esi
push str._ARCH__Forcing_Archive_Scan_on_ScanCon__d__FC1_
jmp 0x495123
cmp dword [0x71de6c], 0
je 0x49514b
push esi
push str._ARCH__Forcing_Archive_Scan_on_ScanCon__d_
lea edx, [ebp - 0x13bc]
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov edx, dword [esi*4 + 0x71de80]
push edi
push 0x1a
push edx
mov dword [ebp - 0xf688], edi
call dword [0x6e90e0]
mov eax, dword [esi*4 + 0x71de80]
add esp, 0xc
push edi
push 0x1b
push eax
call dword [0x6e90e0]
mov ecx, dword [0x685bc0]
mov edx, dword [esi*4 + 0x71de80]
add esp, 0xc
push ecx
push 0x28
push edx
call dword [0x6e90e0]
add esp, 0xc
cmp dword [0x71de6c], 0
je 0x4951b3
mov eax, dword [esi*4 + 0x71de80]
push edi
push 0xff0
push eax
call dword [0x6e90e0]
add esp, 0xc
cmp dword [0x6e91b4], 0
jne 0x4951c5
cmp dword [ebp - 0xf638], 0
je 0x4951d9
mov ecx, dword [esi*4 + 0x71de80]
push edi
push 0x57
push ecx
call dword [0x6e90e0]
add esp, 0xc
push 3
lea edx, [ebp - 0x37c]
push 0x639b78
push edx
call fcn.004dd670
mov esi, dword [ebp - 0xf670]
add esp, 0xc
test eax, eax
jne 0x49520d
cmp esi, 0x24
jne 0x49520d
cmp dword [ebp + 0x28], 0x40
jne 0x49520d
mov ebx, 1
mov edi, ebx
jmp 0x495218
mov edi, dword [ebp - 0xf728]
mov ebx, 1
cmp dword [0x71de6c], 0
je 0x495273
mov eax, dword [ebp - 0xf638]
mov ecx, dword [ebp - 0xf794]
mov edx, dword [ebp - 0xf624]
push eax
mov eax, dword [ebp - 0xf600]
push edi
push ecx
push edx
push eax
lea ecx, [ebp - 0x174]
push ecx
push esi
lea edx, [ebp - 0x13bc]
push str.FType:___d__Ext:___s__Inf:___d__FAS:___d__Scr:___d__STM:___d__FDS:___d_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x34
test esi, esi
je 0x495441
cmp dword [ebp - 0xf600], ebx
je 0x495441
cmp dword [ebp - 0xf62c], ebx
je 0x495441
cmp dword [ebp - 0xf624], ebx
je 0x495441
cmp dword [ebp - 0xf65c], ebx
je 0x495441
cmp dword [ebp - 0xf66c], ebx
je 0x495441
cmp dword [ebp - 0xf680], ebx
je 0x495441
cmp dword [ebp - 0xf640], 0
jne 0x495441
test edi, edi
jne 0x495441
cmp dword [ebp - 0xf6c4], 0xffffffff
mov ebx, 1
mov esi, ebx
jne 0x49532a
mov eax, dword [ebp - 0xf5f0]
mov ecx, dword [ebp - 0xf704]
mov edi, dword [ebp - 0xf60c]
push 4
lea edx, [ebp - 0x37c]
push edx
push eax
push ecx
push edi
call fcn.00467960
add esp, 0x14
mov dword [ebp - 0xf6c4], eax
cmp eax, ebx
jne 0x49532a
mov edx, dword [ebp - 0xf620]
push 0
push edi
push edx
call fcn.00440b50
add esp, 0xc
push 3
lea eax, [ebp - 0x37c]
push 0x639b78
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x495367
cmp dword [ebp - 0xf670], 0x24
jne 0x495367
xor esi, esi
cmp dword [0x685b84], ebx
jne 0x495367
mov dword [ebp - 0xf608], 0xd
mov dword [ebp - 0xf6d0], ebx
cmp dword [0x71de6c], 0
je 0x4953ad
mov ecx, dword [ebp - 0xf608]
mov edx, dword [ebp - 0xf5fc]
push ecx
push esi
push edx
lea eax, [ebp - 0x13bc]
push str.Skipping_Scan...__FC___d__CT___d__dwBd___d_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp dword [ebp - 0xf5fc], 0xffffffff
je 0x49aafb
test esi, esi
je 0x49aafb
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49aafb
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov eax, dword [ebp - 0xf5f0]
push 0
push 0
push ebx
push eax
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x495410
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x49aafb
push 0
push eax
push str.Inserted_in_CacheTree_1_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0xf5f8]
or ebx, 0xffffffff
cmp dword [0x6e98a0], 2
mov esi, 1
je 0x495a89
mov eax, dword [0x6e8ce0]
test eax, eax
jne 0x495d56
cmp dword [ebp - 0xf62c], esi
jne 0x495895
cmp dword [0x71de6c], eax
je 0x4954b9
push edi
lea ecx, [ebp - 0x37c]
push ecx
lea edx, [ebp - 0x13bc]
push str._GUI_Option_Not_Set__Archive_File_With_Extension___s__And_Size__d
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0xf670], ebx
jne 0x495693
mov eax, dword [0x71de6c]
test eax, eax
je 0x4954ea
push 0
push eax
push str.IsItSpecF_d_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea edx, [ebp - 0xf68c]
push edx
lea eax, [ebp - 0xf650]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0xf684]
push ecx
lea edx, [ebp - 0xf6e8]
push edx
push 0
lea eax, [ebp - 0xf64c]
push eax
lea ecx, [ebp - 0xf618]
push ecx
lea edx, [ebp - 0xf654]
push edx
mov edx, dword [ebp - 0xf70c]
lea eax, [ebp - 0xf658]
push eax
mov eax, dword [ebp - 0xf6ac]
lea ecx, [ebp - 0xf67c]
push ecx
push edx
push eax
mov eax, dword [ebp - 0xf714]
lea ecx, [ebp - 0xf698]
push ecx
lea edx, [ebp - 0xf664]
push edx
push eax
lea ecx, [ebp - 0xf600]
push ecx
mov ecx, dword [ebp - 0xf5f4]
push 0
push 0
push 0
lea edx, [ebp - 0xf634]
push edx
mov edx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x174]
push eax
push 0
push ecx
push edx
call fcn.004c1560
add esp, 0x6c
cmp dword [0x71de6c], 0
mov dword [ebp - 0xf670], eax
je 0x49560a
mov ecx, dword [ebp - 0xf650]
mov edx, dword [ebp - 0xf64c]
lea eax, [ebp - 0x174]
push eax
mov eax, dword [ebp - 0xf618]
push ecx
mov ecx, dword [ebp - 0xf654]
push edx
mov edx, dword [ebp - 0xf658]
push eax
mov eax, dword [ebp - 0xf67c]
push ecx
mov ecx, dword [ebp - 0xf698]
push edx
mov edx, dword [ebp - 0xf600]
push eax
mov eax, dword [ebp - 0xf634]
push ecx
push edx
push eax
lea ecx, [ebp - 0x13bc]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x40
cmp dword [ebp - 0xf6f4], 0
jne 0x495625
cmp dword [ebp - 0xf6bc], 0
je 0x495693
cmp dword [ebp - 0xf618], 0
je 0x495693
cmp dword [0x71de6c], 0
je 0x49565c
lea ecx, [ebp - 0x13bc]
push str.Forcing_PopExt_to_SCRIPT_5_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov ecx, dword [str.SCRIPT]
mov dx, word [0x630114]
mov al, byte [0x630116]
mov dword [ebp - 0x174], ecx
mov word [ebp - 0x170], dx
mov byte [ebp - 0x16e], al
mov dword [ebp - 0xf654], esi
mov dword [ebp - 0xf600], esi
mov dword [ebp - 0xf658], esi
cmp dword [ebp - 0xf650], 0
jne 0x4957b0
cmp dword [ebp - 0xf600], esi
je 0x4956d5
cmp dword [ebp - 0xf624], esi
je 0x4956d5
cmp dword [ebp - 0xf65c], esi
je 0x4956d5
cmp dword [ebp - 0xf66c], esi
je 0x4956d5
cmp dword [ebp - 0xf680], esi
je 0x4956d5
cmp dword [ebp - 0xf640], 0
je 0x4957b0
mov dword [ebp - 4], ebx
call fcn.004578c0
shl eax, 0xa
cmp dword [ebp - 0xf5f8], eax
jbe 0x495a7b
mov eax, dword [0x71de6c]
test eax, eax
je 0x49570a
push 0
push eax
push str.File_Size_Is_Greater_Than_The_Limit._Hence_Skipping_The_File
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49aafb
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov ecx, dword [ebp - 0xf5f0]
push 1
push 0
push ebx
push ecx
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x495758
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x49aafb
push 0
push eax
push str.Inserted_in_CacheTree_1b_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
cmp dword [ebp - 0xf724], 0
jne 0x495842
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49aafb
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov ecx, dword [ebp - 0xf5f0]
push 1
push 0
push ebx
push ecx
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x49580b
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
add esp, 4
cmp dword [0x71de6c], 0
je 0x49aafb
mov edx, dword [0x71de6c]
push 0
push edx
push str.Inserted_in_CacheTree_1a_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
cmp dword [0x71de6c], 0
je 0x49aafb
mov eax, dword [0x71de6c]
push 0
push eax
push str.NOT_Inserted_in_CacheTree_1a____DoNotCacheLocally
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
cmp dword [0x71de6c], 0
je 0x4958d4
push edi
lea edx, [ebp - 0x37c]
push edx
lea eax, [ebp - 0x13bc]
push str._GUI_Option_Not_Set__Non_Archive_File_With_Extension___s__And_Size__d
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp dword [ebp - 0xf65c], 0
jne 0x495a7b
cmp dword [ebp - 0xf66c], 0
jne 0x495a7b
cmp dword [ebp - 0xf680], 0
jne 0x495a7b
cmp dword [ebp - 0xf640], 0
jne 0x495a7b
call fcn.004578c0
shl eax, 0xa
cmp edi, eax
jbe 0x495a7b
cmp dword [0x71de6c], 0
je 0x495959
call fcn.004578c0
push eax
shr edi, 0xa
push edi
lea eax, [ebp - 0x13bc]
push str.File_Size__d_KB_Is_Greater_Than_The_Limit_of__d_KB.
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov ecx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x37c]
push eax
push ecx
push 0
mov dword [ebp - 4], 0x1c
call fcn.00469c70
add esp, 0xc
test eax, eax
jne 0x495a5a
lea edx, [ebp - 0x37c]
push edx
lea eax, [ebp - 0xeb70]
push eax
call fcn.00454ac0
add esp, 8
test eax, eax
jne 0x495a47
cmp dword [ebp - 0xf600], eax
jne 0x495a47
mov eax, dword [0x71de6c]
test eax, eax
je 0x4959c8
push 0
push eax
push str.File_Size_Is_Greater_Than_The_Limit._Hence_Skipping_The_File
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49aafb
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov ecx, dword [ebp - 0xf5f0]
push 1
push 0
push ebx
push ecx
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x495a16
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x49aafb
push 0
push eax
push str.Inserted_in_CacheTree_1c_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
mov eax, dword [0x71de6c]
test eax, eax
je 0x495a78
push 0
push eax
push str.Recently_ModifiedFile_With_Versionable_Resource.
jmp 0x495a6b
mov eax, dword [0x71de6c]
test eax, eax
je 0x495a78
push 0
push eax
push str.Present_In_StrongIncludeList.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0xf5f8]
mov esi, 1
or ebx, 0xffffffff
cmp dword [ebp - 0xf670], ebx
jne 0x495c61
cmp dword [ebp - 0xf75c], 0
jne 0x495c61
mov eax, dword [0x71de6c]
test eax, eax
je 0x495ac0
push 0
push eax
push str.IsItSpecF_E_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea eax, [ebp - 0xf68c]
push eax
lea ecx, [ebp - 0xf650]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0xf684]
push edx
lea eax, [ebp - 0xf6e8]
push eax
push 0
lea ecx, [ebp - 0xf64c]
push ecx
lea edx, [ebp - 0xf618]
push edx
lea eax, [ebp - 0xf654]
push eax
mov eax, dword [ebp - 0xf70c]
lea ecx, [ebp - 0xf658]
push ecx
mov ecx, dword [ebp - 0xf6ac]
lea edx, [ebp - 0xf67c]
push edx
push eax
push ecx
mov ecx, dword [ebp - 0xf714]
lea edx, [ebp - 0xf698]
push edx
lea eax, [ebp - 0xf664]
push eax
push ecx
lea edx, [ebp - 0xf600]
push edx
mov edx, dword [ebp - 0xf5f4]
push 0
push 0
push 0
lea eax, [ebp - 0xf634]
push eax
mov eax, dword [ebp - 0xf5f0]
lea ecx, [ebp - 0x174]
push ecx
push 0
push edx
push eax
call fcn.004c1560
add esp, 0x6c
cmp dword [0x71de6c], 0
je 0x495bd9
mov edx, dword [ebp - 0xf650]
mov eax, dword [ebp - 0xf64c]
lea ecx, [ebp - 0x174]
push ecx
mov ecx, dword [ebp - 0xf618]
push edx
mov edx, dword [ebp - 0xf654]
push eax
mov eax, dword [ebp - 0xf658]
push ecx
mov ecx, dword [ebp - 0xf67c]
push edx
mov edx, dword [ebp - 0xf698]
push eax
mov eax, dword [ebp - 0xf600]
push ecx
mov ecx, dword [ebp - 0xf634]
push edx
push eax
push ecx
lea edx, [ebp - 0x13bc]
push str.ita:_d__inf:_d__comp:_d__pdf:_d__php:_d__das:_d__iiae:_d__aapk:_d__blnk:_d__PExt:_s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x40
cmp dword [ebp - 0xf6f4], 0
jne 0x495bf4
cmp dword [ebp - 0xf6bc], 0
je 0x495c61
cmp dword [ebp - 0xf618], 0
je 0x495c61
cmp dword [0x71de6c], 0
je 0x495c2a
lea edx, [ebp - 0x13bc]
push str.Forcing_PopExt_to_SCRIPT_6_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov edx, dword [str.SCRIPT]
mov ax, word [0x630114]
mov cl, byte [0x630116]
mov dword [ebp - 0x174], edx
mov word [ebp - 0x170], ax
mov byte [ebp - 0x16e], cl
mov dword [ebp - 0xf654], esi
mov dword [ebp - 0xf600], esi
mov dword [ebp - 0xf658], esi
xor ebx, ebx
mov dword [ebp - 4], 0x20
cmp dword [ebp - 0xf65c], ebx
jne 0x495fc8
cmp dword [ebp - 0xf66c], ebx
jne 0x495fc8
cmp dword [ebp - 0xf680], ebx
jne 0x495fc8
cmp dword [ebp - 0xf640], ebx
jne 0x495fc8
cmp dword [ebp - 0xf650], ebx
je 0x495fc8
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4917fa
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov edx, dword [ebp - 0xf5f0]
push 1
push 0
push ebx
push edx
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x495cf4
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x4917fa
push 0
push eax
push str.Inserted_in_CacheTree_1f_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf608], 1
jmp 0x49aafb
cmp eax, esi
jne 0x495a89
cmp dword [ebp - 0xf62c], esi
jne 0x495e56
cmp dword [0x71de6c], 0
je 0x495da9
push edi
lea edx, [ebp - 0x37c]
push edx
lea eax, [ebp - 0x13bc]
push str._GUI_Option_Set_Archive_File_With_Extension___s__And_Size__d
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
call fcn.004578c0
shl eax, 0xa
cmp edi, eax
jbe 0x495a89
mov eax, dword [0x71de6c]
test eax, eax
je 0x495dd7
push 0
push eax
push str.File_Size_Is_Greater_Than_The_Limit._Hence_Skipping_The_File
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49aafb
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov eax, dword [ebp - 0xf5f0]
push 1
push 0
push ebx
push eax
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x495e25
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x49aafb
push 0
push eax
push str.Inserted_in_CacheTree_1d_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
cmp dword [0x71de6c], 0
je 0x495e9b
push edi
lea ecx, [ebp - 0x37c]
push ecx
lea edx, [ebp - 0x13bc]
push str._GUI_Option_Set__Non_Archive_File_With_Extension___s__And_Size__d
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
add esp, 0x10
test eax, eax
je 0x495e9b
push 0
push eax
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
call fcn.004578c0
shl eax, 0xa
cmp edi, eax
jbe 0x495a89
mov edx, dword [ebp - 0xf5f0]
lea ecx, [ebp - 0x37c]
push ecx
push edx
push 0
mov dword [ebp - 4], 0x1e
call fcn.00469c70
add esp, 0xc
test eax, eax
jne 0x495f99
lea eax, [ebp - 0x37c]
push eax
lea ecx, [ebp - 0xeb70]
push ecx
call fcn.00454ac0
add esp, 8
test eax, eax
jne 0x495f99
cmp dword [ebp - 0xf600], eax
jne 0x495f99
mov eax, dword [0x71de6c]
test eax, eax
je 0x495f1a
push 0
push eax
push str.File_Size_Is_Greater_Than_The_Limit._Hence_Skipping_The_File
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49aafb
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0x1b
rep movsd dword es:[edi], dword [esi]
call fcn.00441890
mov edx, dword [ebp - 0xf5f0]
push 1
push 0
push ebx
push edx
call fcn.00453f60
add esp, 0x14
test eax, eax
jne 0x495f68
push ebx
call fcn.005e0865
add esp, 4
push 0x1b
call fcn.004418a0
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x49aafb
push 0
push eax
push str.Inserted_in_CacheTree_1e_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49aafb
mov dword [ebp - 4], ebx
jmp 0x495a89
cmp dword [0x71de6c], 0
je 0x496006
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x13bc]
push str.Waiting_on_NAVEx__DetExt:__s_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x1c
call fcn.00441890
add esp, 4
cmp dword [0x72c264], 0
jne 0x496026
push 0x72c264
call fcn.004a68b0
add esp, 4
xor esi, esi
cmp edi, 0xa00000
jae 0x496056
mov ecx, dword [ebp - 0xf5f0]
push ecx
call fcn.004e9f40
test eax, eax
je 0x496056
cmp dword [0x72c240], esi
je 0x496056
cmp dword [0x72be08], 2
jne 0x496056
mov esi, 1
cmp dword [0x71de6c], 0
je 0x4960a1
mov edx, dword [0x72be08]
mov eax, dword [0x72c240]
mov ecx, dword [0x72c264]
push esi
push edx
push eax
push ecx
lea edx, [ebp - 0x74ac]
push str.NAVEx_Locked__dwMS___ld__InfFile___d__CSExt___d__ComputeMD5___d_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x74ac]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
push 0x1c
call fcn.004418a0
add esp, 4
cmp byte [ebp - 0x14c0], 0
jne 0x496184
cmp dword [ebp - 0xf744], 0
jne 0x496184
test esi, esi
je 0x496184
xor esi, esi
cmp dword [0x6862f8], 1
jne 0x4960ed
cmp dword [ebp - 0xf64c], esi
jne 0x4960e8
cmp dword [ebp - 0xf684], esi
je 0x4960ed
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [ebp - 0xf6b8], 1
mov ebx, eax
je 0x4961f7
mov eax, 1
cmp dword [ebp - 0xf618], eax
je 0x4961f7
cmp dword [ebp - 0xf664], 0
jne 0x4961f7
test esi, esi
jne 0x4961f7
mov dword [ebp - 0xf80c], eax
cmp dword [0x71de6c], esi
je 0x49616c
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0xca30]
push str.NonExec_NoHash:___s_
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push esi
push ecx
lea edx, [ebp - 0xca30]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov byte [ebp - 0x1ed8], 0
mov byte [ebp - 0x14c0], 0
mov dword [ebp - 0xf744], 1
mov eax, 1
cmp dword [ebp - 0xf6b8], eax
je 0x4962b2
cmp dword [ebp - 0xf618], eax
je 0x4962b2
cmp dword [ebp - 0xf664], 0
jne 0x4962b2
cmp byte [ebp - 0x14c0], 0
je 0x4964df
cmp dword [0x71de6c], 0
je 0x4965ab
test ebx, ebx
jbe 0x496275
mov edx, dword [ebp - 0xf6b4]
mov eax, dword [ebp - 0xf5f0]
push edx
push eax
lea ecx, [ebp - 0xba30]
push str.NonExec_HC:__s___u_ms_
push ecx
call fcn.005dfb23
add esp, 0x10
jmp 0x496290
mov eax, dword [0x71de6c]
test eax, eax
je 0x496215
push 0
push eax
push str.Computing_Hash_A_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6e91ac], 0
mov edx, dword [ebp - 0xf5f4]
je 0x496234
lea eax, [ebp - 0xf800]
push eax
lea ecx, [ebp - 0x1ed8]
push ecx
jmp 0x496238
push 0
push 0
mov ecx, dword [ebp - 0xf5f0]
push edx
push 0
lea eax, [ebp - 0x14c0]
push eax
push ecx
call fcn.00454f40
add esp, 0x18
test eax, eax
je 0x49616c
cmp byte [ebp - 0x14c0], 0
je 0x49616c
call edi
sub eax, ebx
mov dword [ebp - 0xf6b4], eax
jmp 0x496184
mov edx, dword [ebp - 0xf5f0]
push edx
lea eax, [ebp - 0xba30]
push str.NonExec_HC:__s
push eax
call fcn.005dfb23
add esp, 0xc
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0xba30]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x4964df
xor edi, edi
cmp dword [ebp - 0xf688], edi
jne 0x496333
cmp dword [ebp - 0xf664], edi
je 0x496333
mov eax, dword [ebp - 0xf5f8]
add eax, 0xffff0fff
cmp eax, 0x9ffe
ja 0x496333
lea ecx, [ebp - 0x2bec]
push 0x2e
push ecx
call fcn.005e0940
mov esi, eax
add esp, 8
test esi, esi
je 0x496333
push 5
lea edx, [ebp - 0x2bec]
push str.eicar
push edx
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x496319
push str..exe.part
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x496333
mov eax, dword [ebp - 0xf5f4]
push eax
call fcn.004aab60
add esp, 4
test eax, eax
je 0x496333
mov eax, 1
jmp 0x496378
mov eax, dword [ebp - 0xf624]
test eax, eax
jne 0x496388
cmp dword [ebp - 0xf688], eax
jne 0x496488
cmp dword [ebp - 0xf664], eax
je 0x496488
lea ecx, [ebp - 0x174]
push 0x63a364
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x496488
mov edi, 1
mov eax, edi
mov dword [ebp - 0xf638], 0
mov dword [ebp - 0xf624], eax
mov esi, dword [ebp - 0xf614]
cmp dword [esi*4 + 0x71de80], 0
je 0x496488
cmp eax, 1
jne 0x496488
cmp dword [0x71de6c], 0
je 0x4963f2
push esi
test edi, edi
je 0x4963c1
push str._ARCH___UCL__Forcing_Archive_Scan_on_ScanCon__d_
lea edx, [ebp - 0x13bc]
push edx
jmp 0x4963cd
push str._ARCH___EIC__Forcing_Archive_Scan_on_ScanCon__d_
lea eax, [ebp - 0x13bc]
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [esi*4 + 0x71de80]
push 1
push 0x1a
push eax
mov dword [ebp - 0xf688], 1
call dword [0x6e90e0]
mov ecx, dword [esi*4 + 0x71de80]
add esp, 0xc
push 1
push 0x1b
push ecx
call dword [0x6e90e0]
mov edx, dword [0x685bc0]
mov eax, dword [esi*4 + 0x71de80]
add esp, 0xc
push edx
push 0x28
push eax
call dword [0x6e90e0]
add esp, 0xc
cmp dword [0x71de6c], 0
je 0x496461
mov ecx, dword [esi*4 + 0x71de80]
push 1
push 0xff0
push ecx
call dword [0x6e90e0]
add esp, 0xc
cmp dword [0x6e91b4], 0
jne 0x496473
cmp dword [ebp - 0xf638], 0
je 0x496488
mov edx, dword [esi*4 + 0x71de80]
push 1
push 0x57
push edx
call dword [0x6e90e0]
add esp, 0xc
cmp dword [0x71de6c], 0
je 0x4965ab
mov eax, dword [ebp - 0xf664]
mov ecx, dword [ebp - 0xf618]
mov edx, dword [ebp - 0xf6b8]
push eax
mov eax, dword [ebp - 0xf5f0]
push ecx
push edx
push eax
lea ecx, [ebp - 0xce30]
push str.Reg_Exec:__s__FIV:_u__IAE:_u__PE:_u_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0xce30]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x28
cmp dword [0x71de6c], 0
je 0x4965ab
cmp byte [ebp - 0x14c0], 0
je 0x4965ab
test ebx, ebx
jbe 0x496536
mov eax, dword [ebp - 0xf6b4]
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0x9600]
push eax
cmp eax, 0x64
jbe 0x496526
push str.Hash_Computed___u____s_
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x49654a
push 0x639634
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x49654a
lea eax, [ebp - 0x9600]
push str.Hash_Computed...
push eax
call fcn.005dfb23
add esp, 8
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x9600]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp byte [ebp - 0x1ed8], 0
je 0x4965ab
mov eax, dword [ebp - 0xf800]
push eax
lea ecx, [ebp - 0x1ed8]
push ecx
lea edx, [ebp - 0x9600]
push str.GCRHash_:__s__OL:_d_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x9600]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0x1d
call fcn.00441890
add esp, 4
cmp byte [ebp - 0x14c0], 0
je 0x4967f5
cmp dword [ebp - 0xf65c], 0
jne 0x4967f5
cmp dword [ebp - 0xf66c], 0
jne 0x4967f5
cmp dword [ebp - 0xf680], 0
jne 0x4967f5
cmp dword [ebp - 0xf640], 0
jne 0x4967f5
lea edx, [ebp - 0x14c0]
push edx
call fcn.004547a0
add esp, 4
mov dword [ebp - 0xf6a4], eax
cmp eax, 1
jne 0x4967f5
push 0x3ff
lea eax, [ebp - 0xae2f]
push 0
push eax
mov byte [ebp - 0xae30], 0
call fcn.005dfd60
push 0x207
lea ecx, [ebp - 0x9e1f]
push 0
push ecx
mov byte [ebp - 0x9e20], 0
call fcn.005dfd60
add esp, 0x18
mov ecx, 0x6e9668
lea edx, [ebp - 0xbe30]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x496656
lea edx, [ebp - 0xbe30]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x14c0]
push eax
lea ecx, [ebp - 0xbe30]
push ecx
lea edx, [ebp - 0xd630]
push 0x626500
push edx
call fcn.005dfb23
mov eax, dword [0x6861d0]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4966a5
call fcn.004a6b00
mov dword [0x6861d0], eax
test eax, eax
je 0x49671a
push 0
push 0
push 0
lea eax, [ebp - 0xd630]
push 0
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x49671a
lea ecx, [ebp - 0x14c0]
push ecx
mov ecx, dword [ebp - 0xf5f8]
push eax
push eax
mov eax, dword [ebp - 0xf5f4]
lea edx, [ebp - 0xeb70]
push edx
push eax
push 0
push ecx
lea edx, [ebp - 0x9e20]
push edx
lea eax, [ebp - 0x2bec]
push eax
mov eax, dword [ebp - 0xf5f0]
lea ecx, [ebp - 0xae30]
push ecx
lea edx, [ebp - 0x37c]
push edx
push 0
push 0
push 0x6e9668
push 1
push eax
call fcn.004b1090
add esp, 0x40
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49677b
push 0
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xf5f0]
push ebx
push ecx
call fcn.00453f60
add esp, 0x10
test eax, eax
jne 0x49675d
push ebx
call fcn.005e0865
add esp, 4
mov eax, dword [0x71de6c]
test eax, eax
je 0x496780
push 0
push eax
push str.Inserted_in_CacheTree_2_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x71de6c]
mov esi, 1
cmp dword [ebp - 0xf6a4], esi
jne 0x49679b
test eax, eax
je 0x4967b9
push 0
push eax
push str.Already_Present_In_The_HCache.
jmp 0x4967ac
xor ecx, ecx
cmp ecx, esi
jne 0x4967b9
test eax, eax
je 0x4967b9
push ecx
push eax
push str.Present_In_The_Global_Reg_Cache.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x1d
call fcn.004418a0
add esp, 4
mov dword [ebp - 0xf608], esi
jmp 0x49aafb
push 0x1d
call fcn.004418a0
add esp, 4
mov esi, dword [ebp - 0xf6b0]
mov ebx, dword [ebp - 0xf6a8]
push 0x1e
mov edi, 1
mov dword [ebp - 4], 0x22
call fcn.00441890
add esp, 4
cmp esi, 0xffffffff
jne 0x49683e
mov eax, dword [ebp - 0xf5f0]
lea edx, [ebp - 0xf738]
push edx
push eax
call fcn.00454380
add esp, 8
mov esi, eax
test esi, esi
je 0x496887
mov eax, dword [0x71de6c]
test eax, eax
je 0x496860
push 0
push eax
push str.Already_Present_In_The_Infected_Cache.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x1e
call fcn.004418a0
xor ecx, ecx
add esp, 4
cmp dword [0x685b84], edi
sete cl
lea ecx, [ecx*8 + 2]
mov dword [ebp - 0xf608], ecx
jmp 0x49aafb
push 0x1e
call fcn.004418a0
add esp, 4
cmp byte [ebp - 0x14c0], 0
je 0x4968b3
lea edx, [ebp - 0x14c0]
push edx
lea eax, [ebp - 0x1dd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4969c1
mov edx, dword [ebp - 0xf5f0]
mov cl, byte [edx]
cmp cl, 0x5c
jne 0x4968c5
cmp byte [edx + 1], cl
je 0x4968db
cmp dword [0x72c240], 0
je 0x4968db
cmp dword [0x72be08], 2
jne 0x4968db
xor eax, eax
jmp 0x4968dd
mov eax, edi
cmp dword [ebp - 0xf744], 0
jne 0x4969c1
test eax, eax
jne 0x4969c1
cmp dword [ebp - 0xf5f8], 0xa00000
jae 0x4969c1
xor esi, esi
cmp cl, 0x5c
jne 0x496935
cmp byte [edx + 1], cl
jne 0x496935
mov ecx, dword [ebp - 0xf5f4]
push ecx
call fcn.004d90d0
add esp, 4
test eax, eax
jne 0x496935
push eax
lea edx, [ebp - 0x13bc]
push edx
push eax
call fcn.00504d70
test eax, eax
jne 0x496935
mov esi, edi
mov eax, dword [0x71de6c]
test eax, eax
je 0x496953
push 0
push eax
push str.Computing_Hash_B_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [ebp - 0xf5f4]
mov edx, dword [ebp - 0xf5f0]
push 0
push 0
push eax
push 0
lea ecx, [ebp - 0x1dd4]
push ecx
push edx
call fcn.00454f40
add esp, 0x18
test eax, eax
jne 0x4969b7
cmp dword [0x71de6c], eax
je 0x4969b7
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x13bc]
push str.Error_getting_hash_of__s_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp esi, edi
jne 0x4969c1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push 0x1f
call fcn.00441890
push 0x103
xor esi, esi
lea ecx, [ebp - 0x4737]
push esi
push ecx
mov byte [ebp - 0x4738], 0
call fcn.005dfd60
add esp, 0x10
cmp byte [ebp - 0x1dd4], 0
je 0x49709a
cmp dword [0x6e9190], esi
jne 0x49709a
mov eax, dword [ebp - 0xf618]
cmp dword [ebp - 0xf6b8], esi
jne 0x496a2d
cmp eax, esi
jne 0x496a2d
cmp dword [ebp - 0xf664], esi
jne 0x496a2d
cmp dword [ebp - 0xf64c], esi
jne 0x496a2d
cmp dword [ebp - 0xf684], esi
je 0x49709a
mov ecx, dword [ebp - 0xf65c]
cmp ecx, esi
jne 0x497028
cmp dword [ebp - 0xf66c], esi
jne 0x497028
cmp dword [ebp - 0xf680], esi
jne 0x497028
cmp dword [ebp - 0xf640], esi
jne 0x497028
mov eax, dword [0x71de6c]
cmp eax, esi
je 0x496a7c
push esi
push eax
push str.Searching_Clnsigns...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push esi
lea edx, [ebp - 0x4738]
push edx
lea eax, [ebp - 0x1dd4]
push eax
call fcn.005c86d0
add esp, 0xc
cmp eax, esi
je 0x496d66
cmp dword [0x71de6c], esi
je 0x496ad6
lea ecx, [ebp - 0x4738]
push ecx
lea edx, [ebp - 0x13bc]
push str.CS_:__s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push esi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x3ff
lea edx, [ebp - 0xb22f]
push esi
push edx
mov byte [ebp - 0xb230], 0
call fcn.005dfd60
push 0x207
lea eax, [ebp - 0x9807]
push esi
push eax
mov byte [ebp - 0x9808], 0
call fcn.005dfd60
add esp, 0x18
cmp byte [ebp - 0x14c0], 0
je 0x496bdd
xor esi, esi
cmp dword [0x71de6c], esi
je 0x496b2a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, dword [0x6861d0]
cmp eax, 0xffffffff
jne 0x496b3e
call fcn.004a6b00
mov dword [0x6861d0], eax
test eax, eax
je 0x496bdd
mov eax, dword [ebp - 0xf5f4]
lea ecx, [ebp - 0x14c0]
push ecx
mov ecx, dword [ebp - 0xf5f8]
push 0
push 0
lea edx, [ebp - 0xeb70]
push edx
push eax
push 0
push ecx
lea edx, [ebp - 0x9808]
push edx
lea eax, [ebp - 0x2bec]
push eax
mov eax, dword [ebp - 0xf5f0]
lea ecx, [ebp - 0xb230]
push ecx
lea edx, [ebp - 0x37c]
push edx
push 0
push 0
push 0x6e9668
push edi
push eax
call fcn.004b1090
add esp, 0x40
cmp dword [0x71de6c], 0
je 0x496bdd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
push eax
lea ecx, [ebp - 0x13bc]
push str._BK_Inserted_into_Bkup_Tree___d_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x496c3e
push 0
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 1
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xf5f0]
push ebx
push ecx
call fcn.00453f60
add esp, 0x10
test eax, eax
jne 0x496c20
push ebx
call fcn.005e0865
add esp, 4
mov eax, dword [0x71de6c]
test eax, eax
je 0x496c3e
push 0
push eax
push str.Inserted_in_CacheTree_5_Permanent_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov edx, dword [ebp - 0xf5f0]
push edx
lea ecx, [ebp - 0xf8ac]
call fcn.004029f0
lea eax, [ebp - 0xeb70]
push eax
lea ecx, [ebp - 0xf8ac]
push ecx
lea ecx, [ebp - 0xfcc0]
mov byte [ebp - 4], 0x23
call fcn.0048b440
push eax
lea ecx, [ebp - 0xfb64]
mov byte [ebp - 4], 0x24
call fcn.0048b480
lea edx, [ebp - 0xfb64]
push edx
lea eax, [ebp - 0xf848]
push eax
mov ecx, 0x7600b4
mov byte [ebp - 4], 0x25
call fcn.0048cf10
lea ecx, [ebp - 0xfb64]
call fcn.005410f0
lea ecx, [ebp - 0xfcc0]
call fcn.005410f0
lea ecx, [ebp - 0xf8ac]
mov byte [ebp - 4], 0x22
call fcn.005410f0
mov eax, dword [0x71de6c]
test eax, eax
je 0x496cdc
push 0
push eax
push str.Inserted_in_CLCache_5a_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov edx, dword [ebp - 0xf5f0]
lea ecx, [ebp - 0xeb70]
push ecx
push edx
call fcn.005530d0
add esp, 8
push 0x732ea4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x732ea4]
cmp eax, 0x14
jl 0x496d41
call fcn.00552ff0
push 0x6afad0
call fcn.00552ed0
mov eax, dword [0x71de6c]
add esp, 4
mov dword [0x732ea4], 0
test eax, eax
je 0x496d41
push 0
push eax
push str.CLCache_File_Written_5a_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x1f
call fcn.004418a0
lea ecx, [ebp - 0x1dd4]
push ecx
call fcn.00557d10
add esp, 8
mov dword [ebp - 0xf608], 1
jmp 0x49aafb
push 0x75fc98
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 0x1dd4]
push edx
lea ecx, [ebp - 0xf890]
call fcn.004029f0
mov eax, dword [0x76004c]
mov ecx, dword [0x760034]
or dword [ebp - 0xf6e4], edi
lea edx, [ebp - 0xf840]
mov dword [ebp - 0xf83c], eax
push edx
mov dword [ebp - 0xf840], ecx
lea eax, [ebp - 0xf890]
push eax
lea ecx, [ebp - 0xf850]
push ecx
mov ecx, 0x760034
call fcn.0048b3a0
mov ecx, eax
call fcn.00476fa0
test al, al
je 0x496de7
cmp ebx, 0x19
jge 0x496de3
cmp ebx, 4
jle 0x496de7
and ebx, 0x80000001
jns 0x496de1
dec ebx
or ebx, 0xfffffffe
inc ebx
je 0x496de7
mov bl, 1
jmp 0x496de9
xor bl, bl
test byte [ebp - 0xf6e4], 1
je 0x496dfd
lea ecx, [ebp - 0xf890]
call fcn.005410f0
push 0x75fc98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x496f8e
push 0x140
call fcn.004d9470
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x496e71
push 0
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
mov edi, ebx
push 0
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0xf5f0]
push ebx
push edx
call fcn.00453f60
add esp, 0x10
test eax, eax
jne 0x496e53
push ebx
call fcn.005e0865
add esp, 4
mov eax, dword [0x71de6c]
test eax, eax
je 0x496e71
push 0
push eax
push str.Inserted_in_CacheTree_5a_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0xf874]
call fcn.004029f0
lea ecx, [ebp - 0xeb70]
push ecx
lea edx, [ebp - 0xf874]
push edx
lea ecx, [ebp - 0xfe1c]
mov byte [ebp - 4], 0x26
call fcn.0048b440
push eax
lea ecx, [ebp - 0xfa08]
mov byte [ebp - 4], 0x27
call fcn.0048b480
lea eax, [ebp - 0xfa08]
push eax
lea ecx, [ebp - 0xf858]
push ecx
mov ecx, 0x7600b4
mov byte [ebp - 4], 0x28
call fcn.0048cf10
lea ecx, [ebp - 0xfa08]
call fcn.005410f0
lea ecx, [ebp - 0xfe1c]
call fcn.005410f0
lea ecx, [ebp - 0xf874]
mov byte [ebp - 4], 0x22
call fcn.005410f0
mov eax, dword [0x71de6c]
test eax, eax
je 0x496f0f
push 0
push eax
push str.Inserted_in_CLCache_5c_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [ebp - 0xf5f0]
lea edx, [ebp - 0xeb70]
push edx
push eax
call fcn.005530d0
add esp, 8
push 0x732ea4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x732ea4]
cmp ecx, 0x14
jl 0x496f75
call fcn.00552ff0
push 0x6afad0
call fcn.00552ed0
mov eax, dword [0x71de6c]
add esp, 4
mov dword [0x732ea4], 0
test eax, eax
je 0x496f75
push 0
push eax
push str.CLCache_File_Written_5d_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x1f
call fcn.004418a0
add esp, 4
mov dword [ebp - 0xf608], 1
jmp 0x49aafb
push 0x1f
call fcn.004418a0
add esp, 4
cmp dword [0x6862f8], edi
jne 0x4970a4
mov eax, dword [ebp - 0xf664]
cmp eax, esi
jne 0x496fca
cmp dword [ebp - 0xf618], esi
jne 0x496fca
cmp dword [ebp - 0xf64c], esi
jne 0x496fca
cmp dword [ebp - 0xf684], esi
je 0x4970a4
mov dword [ebp - 0xf700], edi
cmp eax, esi
jne 0x496fdc
cmp dword [ebp - 0xf618], esi
je 0x496fef
cmp dword [ebp - 0xf6e8], esi
jne 0x496fef
mov dword [ebp - 0xf6f8], edi
jmp 0x4970a4
mov dword [ebp - 0xf6f8], esi
jmp 0x4970a4
mov edx, dword [ebp - 0xf64c]
cmp edx, esi
jne 0x49703a
cmp dword [ebp - 0xf684], esi
je 0x49709a
cmp ecx, esi
jne 0x49709a
cmp dword [ebp - 0xf66c], esi
jne 0x49709a
cmp dword [ebp - 0xf680], esi
jne 0x49709a
cmp dword [ebp - 0xf640], esi
jne 0x49709a
cmp dword [0x6862f8], edi
jne 0x49709a
mov ecx, dword [ebp - 0xf664]
cmp ecx, esi
jne 0x497078
cmp eax, esi
jne 0x497078
cmp edx, esi
jne 0x497078
cmp dword [ebp - 0xf684], esi
je 0x49709a
mov dword [ebp - 0xf700], edi
cmp ecx, esi
jne 0x497086
cmp eax, esi
je 0x497094
mov dword [ebp - 0xf6f8], edi
cmp dword [ebp - 0xf6e8], esi
je 0x49709a
mov dword [ebp - 0xf6f8], esi
push 0x1f
call fcn.004418a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0xf614]
xor ebx, ebx
cmp dword [0x6e91b8], 2
jne 0x4970ed
cmp dword [0x741270], ebx
jne 0x4970e3
push ebx
push 1
push str._MONITOR_SET_FOR_SKIP_ONLY_SCANS_2_...
push 0x6aec98
mov dword [0x741270], 1
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x685b84]
jmp 0x49aaea
cmp byte [ebp - 0x2bec], 0
je 0x4972ce
mov eax, dword [0x72c29c]
mov dword [ebp - 0xf6c0], ebx
cmp eax, ebx
je 0x49710e
cmp byte [eax], 0
jne 0x497141
mov edx, dword [ebp - 0xf5f8]
mov ecx, dword [ebp - 0xf618]
push edx
lea eax, [ebp - 0xf6c0]
push eax
push ecx
lea edx, [ebp - 0x2bec]
push edx
lea eax, [ebp - 0x37c]
push eax
call fcn.004534f0
add esp, 0x14
test eax, eax
je 0x4972ce
push 0x1f
xor edi, edi
call fcn.00441890
add esp, 4
cmp dword [ebp - 0xf6c0], ebx
jne 0x4971e9
mov eax, dword [0x72c29c]
cmp eax, ebx
je 0x4971e9
cmp byte [eax], 0
je 0x4971e9
push 1
push ebx
push 0x2c
lea ecx, [ebp - 0xf758]
push ecx
lea edx, [ebp - 0x9c18]
push edx
push eax
mov dword [ebp - 0xf758], ebx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0xf758], 0xffffffff
je 0x4971ee
jmp 0x4971a0
lea eax, [ebp - 0x2bec]
push eax
lea ecx, [ebp - 0x9c18]
push ecx
call fcn.004cd350
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x4971ee
mov ecx, dword [0x72c29c]
push 1
push ebx
push 0x2c
lea edx, [ebp - 0xf758]
push edx
lea eax, [ebp - 0x9c18]
push eax
push ecx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0xf758], 0xffffffff
jne 0x4971a0
jmp 0x4971ee
mov edi, 1
push 0x1f
call fcn.004418a0
add esp, 4
cmp edi, ebx
je 0x4972ce
cmp dword [ebp - 0xf688], ebx
jne 0x4972ce
mov edi, 1
mov dword [ebp - 0xf638], edi
mov dword [ebp - 0xf624], edi
cmp dword [esi*4 + 0x71de80], ebx
je 0x49aafb
cmp dword [0x71de6c], ebx
je 0x49725f
push esi
lea edx, [ebp - 0x13bc]
push str._ARCH___FAS__Forcing_Archive_Scan_on_ScanCon__d_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push ebx
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov edx, dword [esi*4 + 0x71de80]
push edi
push 0x1a
push edx
call dword [0x6e90e0]
mov eax, dword [esi*4 + 0x71de80]
push edi
push 0x1b
push eax
call dword [0x6e90e0]
mov ecx, dword [0x685bc0]
mov edx, dword [esi*4 + 0x71de80]
push ecx
push 0x28
push edx
call dword [0x6e90e0]
add esp, 0x24
cmp dword [0x71de6c], ebx
je 0x4972ba
mov eax, dword [esi*4 + 0x71de80]
push edi
push 0xff0
push eax
call dword [0x6e90e0]
add esp, 0xc
mov ecx, dword [esi*4 + 0x71de80]
push edi
push 0x57
push ecx
call dword [0x6e90e0]
add esp, 0xc
cmp dword [esi*4 + 0x71de80], ebx
je 0x49aafb
mov dword [ebp - 0xf610], ebx
mov dword [ebp - 0xf628], 1
mov dword [ebp - 0xf710], ebx
mov dword [ebp - 0xf6ac], ebx
mov dword [ebp - 0xf69c], ebx
mov dword [ebp - 0xf718], ebx
mov dword [ebp - 0xf71c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x207
lea edx, [ebp - 0x18cf]
push ebx
push edx
mov dword [ebp - 0xf6dc], eax
mov byte [ebp - 0x18d0], 0
call fcn.005dfd60
mov edi, dword [ebp - 0xf614]
mov dword [ebp - 0xf6d8], ebx
mov ebx, edi
imul ebx, ebx, 0xa00
push 0xa00
lea esi, [ebx + 0x71ded8]
push 0
push esi
mov dword [ebp - 4], 0x2a
call fcn.005dfd60
mov ecx, dword [ebp - 0xf65c]
mov edx, dword [ebp - 0xf66c]
mov eax, 1
mov dword [ebx + 0x71e8b0], eax
mov dword [ebx + 0x71e89c], ecx
mov dword [ebx + 0x71e8a0], edx
mov ecx, dword [ebp - 0xf680]
mov edx, dword [ebp - 0xf640]
mov dword [ebx + 0x71e8a4], ecx
mov dword [ebx + 0x71e8a8], edx
mov edx, dword [ebp - 0xf6b8]
add esp, 0x18
xor ecx, ecx
mov dword [ebx + 0x71e890], ecx
mov dword [ebx + 0x71e860], edx
mov edx, dword [ebp - 0xf618]
mov dword [ebx + 0x71e86c], edx
mov edx, dword [ebp - 0xf6f8]
mov dword [ebx + 0x71e864], edx
mov edx, dword [ebp - 0xf700]
mov dword [ebx + 0x71e868], edx
mov edx, dword [ebp - 0xf6f0]
mov dword [ebx + 0x71def4], edx
mov edx, dword [ebp - 0xf5f4]
mov dword [ebx + 0x71def8], edx
mov edx, dword [ebp - 0xf60c]
mov dword [ebx + 0x71defc], edx
mov edx, dword [ebp - 0xeb70]
mov dword [ebx + 0x71e878], ecx
mov ecx, dword [ebp - 0xf730]
mov dword [esi], ecx
mov ecx, dword [ebp - 0xf5f8]
mov dword [ebx + 0x71deec], edx
mov edx, dword [ebp - 0xf624]
mov dword [ebx + 0x71def0], ecx
mov ecx, dword [ebp - 0xf638]
mov dword [ebx + 0x71e870], eax
mov dword [ebx + 0x71e880], edx
mov edx, dword [ebp - 0xf794]
mov dword [ebx + 0x71e884], ecx
mov ecx, dword [ebp - 0xf768]
mov dword [ebx + 0x71e874], eax
mov eax, dword [ebp - 0xf7a0]
mov byte [ebx + 0x71e8b9], 0
mov byte [ebx + 0x71e8ba], 0
mov byte [ebx + 0x71e8bb], 0
mov byte [ebx + 0x71e8bc], 0
mov dword [ebx + 0x71e8c0], edx
mov edx, dword [ebp - 0xf67c]
mov dword [ebx + 0x71e894], eax
mov eax, dword [ebp - 0xf654]
mov dword [ebx + 0x71e898], ecx
mov ecx, dword [ebp - 0xf64c]
mov dword [ebx + 0x71e8c4], edx
mov dword [ebx + 0x71e8d0], eax
mov dword [ebx + 0x71e8ac], ecx
mov edx, dword [ebp - 0xf658]
mov eax, dword [ebp - 0xf75c]
mov dword [ebx + 0x71e8c8], edx
mov dword [ebx + 0x71e8cc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0xf6b4]
mov edx, dword [ebp - 0xf668]
mov dword [ebx + 0x71dee0], eax
mov dword [ebx + 0x71dee4], ecx
xor eax, eax
mov dword [ebx + 0x71e88c], eax
mov dword [ebx + 0x71e888], eax
mov eax, dword [edi*4 + 0x71de80]
mov dword [ebx + 0x71e8d4], edx
mov dword [ebx + 0x71dee8], eax
lea edi, [ebx + 0x71e310]
mov ecx, 0x50
lea esi, [ebp - 0xeb70]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x14c0]
push ecx
lea edx, [ebx + 0x71e004]
push edx
call esi
lea eax, [ebp - 0x1dd4]
push eax
lea ecx, [ebx + 0x71e108]
push ecx
call esi
lea edx, [ebp - 0x1ed8]
push edx
lea eax, [ebx + 0x71e20c]
push eax
call esi
mov ecx, dword [ebp - 0xf5f0]
push 0x40f
push ecx
lea edx, [ebx + 0x71e450]
push edx
call fcn.005e2f3c
add esp, 0xc
cmp dword [0x71de6c], 0
je 0x49759d
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x13bc]
push str.Scanning_File:__s
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [0x6b1008], 0
je 0x497669
cmp dword [ebp - 0xf810], 0
jne 0x497608
cmp dword [0x71de6c], 0
jne 0x497608
cmp dword [ebp - 0xf62c], 1
je 0x4975eb
cmp dword [ebp - 0xf624], 0
jne 0x4975eb
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0x13bc]
push str._NORM___s
push edx
call fcn.005dfb23
add esp, 0xc
jmp 0x497651
mov eax, dword [ebp - 0xf5f0]
push eax
lea ecx, [ebp - 0x13bc]
push str._ARCH___s
push ecx
call fcn.005dfb23
add esp, 0xc
jmp 0x497651
cmp dword [ebp - 0xf62c], 1
je 0x49762f
cmp dword [ebp - 0xf624], 0
jne 0x49762f
mov edx, dword [ebp - 0xf5f8]
mov eax, dword [ebp - 0xf5f0]
push edx
push eax
push str._NORM___s___lu_
jmp 0x497642
mov edx, dword [ebp - 0xf5f8]
mov eax, dword [ebp - 0xf5f0]
push edx
push eax
push str._ARCH___s___lu_
lea ecx, [ebp - 0x13bc]
push ecx
call fcn.005dfb23
add esp, 0x10
push 0
push 1
lea edx, [ebp - 0x13bc]
push edx
push 0x6b1008
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
xor edi, edi
cmp dword [0x685bd0], 2
mov esi, 1
ja 0x497c07
mov eax, dword [ebp - 0xf5f0]
cmp byte [eax], 0x5c
jne 0x497c07
mov ecx, eax
cmp byte [ecx + 1], 0x5c
jne 0x497c07
mov ebx, 0x2c
mov dword [ebp - 0xf7a4], edi
mov dword [ebp - 0xf734], edi
mov dword [ebp - 0xf6d4], edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], ebx
mov dword [ebp - 0xf688], edi
jne 0x4976f2
cmp byte [eax + 1], 0x5c
jne 0x4976f2
mov eax, dword [0x74126c]
mov byte [ebp - 4], 0x2d
cmp eax, edi
je 0x4976e4
push eax
call fcn.004e4d00
add esp, 4
cmp eax, esi
je 0x4976ef
push edi
call fcn.0050acc0
mov dword [0x74126c], eax
mov dword [ebp - 4], ebx
push 0x63c
xor esi, esi
lea edx, [ebp - 0xf5ec]
push esi
push edx
call fcn.005dfd60
mov ecx, dword [ebp - 0xf5f0]
add esp, 0xc
lea edx, [ebp - 0xf5e4]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x497715
mov eax, dword [ebp - 0xf614]
mov ecx, dword [eax*4 + 0x71de80]
mov edx, dword [ebp - 0xf5f4]
mov ebx, eax
imul ebx, ebx, 0xa00
mov dword [ebp - 0xf5ec], ecx
mov ecx, dword [ebp - 0xf730]
mov dword [eax*4 + 0x72bb30], esi
mov eax, dword [0x71de6c]
mov dword [ebp - 0xefcc], edx
mov edx, dword [0x74126c]
mov dword [ebp - 0xefbc], ecx
lea ecx, [ebx + 0x71ded8]
mov dword [ebp - 0xefc8], esi
mov dword [ebp - 0xefc4], 1
mov dword [ebp - 0xefc0], esi
mov byte [ebp - 0xf1d4], 0
mov dword [ebp - 0xefb8], edx
mov dword [ebp - 0xefb4], esi
mov dword [ebp - 0xf5e8], ecx
cmp eax, esi
je 0x4977b1
push esi
push eax
push str.Creating_Scanning_Thread
push 0x6aec98
call fcn.004311c0
add esp, 0x10
lea edx, [ebp - 0xf7a4]
push edx
push esi
lea eax, [ebp - 0xf5ec]
push eax
push 0x45d0c0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xf6d4], eax
cmp eax, esi
jne 0x49787b
lea ecx, [ebp - 0x80dc]
push 0x104
push ecx
call fcn.004d8c20
add esp, 8
lea edx, [ebp - 0x80dc]
push edx
lea eax, [ebp - 0x13bc]
push str.CreateThread_Fails._Reason:__s
push eax
call fcn.005dfb23
push esi
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0xf610], 0xc0000000
jmp 0x497bc8
mov edx, dword [ebp - 0xf7a4]
push edx
push 0xffffffffffffffff
push str.SCAN_THRD_4a
call fcn.00420720
add esp, 0xc
cmp dword [0x71de6c], esi
je 0x4978cd
mov eax, dword [ebp - 0xf7a4]
push eax
lea ecx, [ebp - 0x13bc]
push str.Scanning_Thread_Created_Successfully__Tid___d_.
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push esi
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp byte [ebx + 0x71e8b8], 0
jne 0x497934
call fcn.004e03f0
inc esi
cmp esi, 0x64
jbe 0x4978d7
xor esi, esi
cmp dword [0x685bd0], 2
ja 0x497905
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1fbd0
ja 0x49792a
mov edx, dword [ebp - 0xf6d4]
lea ecx, [ebp - 0xf734]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
jne 0x4978d7
cmp dword [ebp - 0xf734], 0x103
je 0x4978d7
mov dword [ebp - 0xf688], 0x102
mov eax, dword [0x71de6c]
test eax, eax
je 0x497962
cmp byte [ebx + 0x71e8b8], 1
push 0
push eax
jne 0x497950
push str.Scan_CallbackStarted__True.
jmp 0x497955
push str.Scan_CallbackStarted__False.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp byte [ebx + 0x71e8b8], 1
jne 0x497989
cmp dword [0x685bd0], 2
jbe 0x497a1e
mov eax, dword [ebp - 0xf6d4]
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp dword [ebp - 0xf688], 0x102
jne 0x497b77
mov ecx, dword [ebp - 0xf6d4]
lea eax, [ebp - 0xf734]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edi, 1
cmp eax, edi
jne 0x4979c6
cmp dword [ebp - 0xf734], 0x103
jne 0x497b7c
mov eax, dword [ebp - 0xefb4]
test eax, eax
je 0x4979d2
mov dword [eax], edi
mov edx, dword [0x71de6c]
mov dword [ebp - 0xf69c], edi
test edx, edx
je 0x4979fd
push 0
push edx
push str.Wait_Is_Over.
push 0x6aec98
call fcn.004311c0
mov edx, dword [0x71de6c]
add esp, 0x10
mov ecx, dword [ebx + 0x71e8b4]
test ecx, ecx
jbe 0x497aa1
mov eax, dword [ebx + 0x71e8b0]
xor esi, esi
mov dword [ebp - 0xf628], eax
jmp 0x497aa6
mov esi, 0xea60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [ebp - 0xf6a4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xf6a4]
cmp eax, 0x2bf20
jae 0x497989
mov ecx, dword [ebp - 0xf6d4]
push 0
push esi
push ecx
call edi
mov dword [ebp - 0xf688], eax
cmp eax, 0x102
jne 0x497b77
cmp dword [ebx + 0x71e8b4], 0
jbe 0x497a35
mov edx, dword [ebp - 0xf6d4]
push 0
push esi
push edx
call edi
mov dword [ebp - 0xf688], eax
cmp eax, 0x102
jne 0x497b77
cmp dword [ebx + 0x71e8b4], 1
je 0x497989
mov esi, 0xc0000000
mov eax, dword [ebp - 0xf5f0]
mov dword [ebp - 0xf610], esi
cmp ecx, edi
jne 0x497ac1
mov edi, 1
mov ecx, dword [ebp - 0xefc8]
mov edx, dword [ebp - 0xefc4]
mov dword [ebp - 0xf610], ecx
mov dword [ebp - 0xf628], edx
cmp byte [ebp - 0xf1d4], 0
je 0x497bbc
lea ecx, [ebp - 0xf1d4]
lea edx, [ebp - 0x18d0]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
test al, al
jne 0x497bb0
lea eax, [ebp - 0xf6d4]
push eax
call fcn.004dca10
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0xf610]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x498193
mov eax, dword [ebp - 0xf5f0]
cmp byte [eax], 0x5c
mov dword [ebp - 0xf728], edi
mov dword [ebp - 0xf6b0], edi
jne 0x497d29
cmp byte [eax + 1], 0x5c
jne 0x497d29
mov eax, dword [ebp - 0xf5f4]
mov ecx, dword [str.NETSCAN]
mov edx, dword [0x639034]
push eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
call fcn.004d90d0
add esp, 4
test eax, eax
jne 0x497d3a
push edi
lea ecx, [ebp - 0x13bc]
push ecx
push edi
call fcn.00504d70
test eax, eax
mov eax, dword [0x71de6c]
jne 0x497c8f
cmp eax, edi
je 0x497c84
push edi
push eax
push str.IMPERSONATE:_SUCCESS
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 0xf6b0], esi
jmp 0x497d3a
cmp eax, edi
je 0x497cac
push edi
push eax
push str.IMPERSONATE:_FAILURE__Will_get_and_pass_EXPLORER_PID_
push 0x6aec98
call fcn.004311c0
mov eax, dword [0x71de6c]
add esp, 0x10
mov ecx, dword [0x74126c]
cmp ecx, edi
je 0x497cc8
push ecx
call fcn.004e4d00
add esp, 4
cmp eax, esi
je 0x497ceb
mov eax, dword [0x71de6c]
cmp eax, edi
je 0x497ce0
push edi
push eax
push str.GETTING_Explorer_PID
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push edi
call fcn.0050acc0
mov dword [0x74126c], eax
cmp dword [0x71de6c], edi
je 0x497d3a
mov edx, dword [0x74126c]
push edx
lea eax, [ebp - 0x13bc]
push str.ExplorerPID_a_:_u
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x497d3a
mov eax, dword [str.LOCSCAN]
mov ecx, dword [0x638fb0]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
cmp dword [0x6e9168], esi
jne 0x497d52
push 0x20
mov dword [ebp - 0xf728], esi
call fcn.00441890
add esp, 4
mov dword [ebp - 4], 0x30
cmp dword [0x71de6c], edi
je 0x497ec4
cmp dword [0x72bdf8], edi
je 0x497ec4
mov edx, dword [ebp - 0xf668]
push edx
lea eax, [ebp - 0x13bc]
push str._SMART__FileBeingSaved:_u_
push eax
mov dword [ebp - 0xf6c0], edi
mov dword [ebp - 0xf6e4], edi
call fcn.005dfb23
add esp, 0xc
xor ebx, ebx
lea ebx, [ebx]
cmp ebx, dword [0x685bd0]
jae 0x497e63
mov edx, dword [ebx*4 + 0x71de80]
lea ecx, [ebp - 0xf804]
push ecx
push 0x1389
push edx
mov dword [ebp - 0xf7b4], edi
mov dword [ebp - 0xf804], edi
call dword [0x6e90e4]
mov ecx, dword [ebx*4 + 0x71de80]
add esp, 0xc
lea eax, [ebp - 0xf7b4]
push eax
push 0xfee
push ecx
call dword [0x6e90e4]
mov eax, dword [ebp - 0xf804]
add esp, 0xc
cmp eax, edi
jbe 0x497e08
add dword [ebp - 0xf6e4], eax
mov dword [ebp - 0xf6c0], esi
mov edx, dword [ebp - 0xf7b4]
push edx
push eax
push ebx
lea eax, [ebp - 0x82e4]
push str._SkF__u____u__u__
push eax
call fcn.005dfb23
lea eax, [ebp - 0x82e4]
add esp, 0x14
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x497e30
lea edi, [ebp - 0x13bc]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x497e42
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc ebx
xor edi, edi
lea esi, [edi + 1]
jmp 0x497da0
cmp dword [ebp - 0xf6c0], edi
je 0x497e9e
mov ecx, dword [ebp - 0xf6e4]
push ecx
lea edx, [ebp - 0x3bc]
push str._SMART_u_
push edx
call fcn.005dfb23
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x13bc]
push str._SMART_
push ecx
call fcn.004e9030
add esp, 0x18
mov edx, dword [0x71de6c]
push edi
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
xor eax, eax
add esp, 0x10
cmp eax, edi
jne 0x49851e
mov ecx, dword [ebp - 0xf5f4]
cmp ecx, edi
je 0x498380
xor eax, eax
cmp eax, edi
jne 0x498380
xor esi, esi
mov dword [0x6e9088], 1
mov dword [ebp - 0xf7bc], eax
mov dword [ebp - 0xf6b4], 5
mov edi, 0xc8
cmp dword [0x6861c0], esi
je 0x497f25
mov edx, dword [ebp - 0xf5f8]
push edx
lea eax, [ebp - 0xf7bc]
push eax
push ecx
mov ecx, dword [ebp - 0xf5f0]
push ecx
call fcn.0045e330
add esp, 0x10
mov esi, eax
cmp dword [0x71de6c], 0
je 0x498048
mov ebx, dword [ebp - 0xf614]
xor eax, eax
lea edx, [ebp - 0xf74c]
push edx
mov dword [ebp - 0xf74c], eax
mov dword [ebp - 0xf754], eax
mov dword [ebp - 0xf72c], eax
mov eax, dword [ebx*4 + 0x71de80]
push 0x1a
push eax
call dword [0x6e90e4]
mov edx, dword [ebx*4 + 0x71de80]
add esp, 0xc
lea ecx, [ebp - 0xf754]
push ecx
push 0x1b
push edx
call dword [0x6e90e4]
mov ecx, dword [ebx*4 + 0x71de80]
add esp, 0xc
lea eax, [ebp - 0xf72c]
push eax
push 0x57
push ecx
call dword [0x6e90e4]
add esp, 0xc
test esi, esi
je 0x497ffe
cmp dword [0x6e9100], 0
je 0x497fd7
cmp dword [0x72bb94], 0
jne 0x497fd7
mov edx, dword [ebp - 0xf72c]
mov eax, dword [ebp - 0xf754]
mov ecx, dword [ebp - 0xf74c]
push edx
push eax
push ecx
lea edx, [ebp - 0x20]
push edx
push str.__s__Scan_Obj_Buffer_Ex__Arch_u__Eml_u__Deep_u_
lea eax, [ebp - 0x13bc]
push eax
jmp 0x498023
mov ecx, dword [ebp - 0xf72c]
mov edx, dword [ebp - 0xf754]
mov eax, dword [ebp - 0xf74c]
push ecx
push edx
push eax
lea ecx, [ebp - 0x20]
push ecx
push str.__s__Scan_Obj_Buffer__Arch_u__Eml_u__Deep_u_
lea edx, [ebp - 0x13bc]
push edx
jmp 0x498023
mov eax, dword [ebp - 0xf72c]
mov ecx, dword [ebp - 0xf754]
mov edx, dword [ebp - 0xf74c]
push eax
push ecx
push edx
lea eax, [ebp - 0x20]
push eax
push str.__s__Scan_Obj_by_Handle__Arch_u__Eml_u__Deep_u_
lea ecx, [ebp - 0x13bc]
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
add esp, 0x18
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
test esi, esi
je 0x4982b0
cmp dword [0x6e9100], 0
mov ecx, dword [ebp - 0xf5f8]
mov dword [ebp - 0xf7e4], ecx
je 0x4980d9
cmp dword [0x72bb94], 0
jne 0x4980d9
xor ebx, ebx
cmp ebx, dword [ebp - 0xf6b4]
jae 0x49813e
lea edx, [ebp - 0xf6d8]
push edx
lea eax, [ebp - 0xf710]
push eax
mov eax, dword [ebp - 0xf5f8]
lea ecx, [ebp - 0xf628]
push ecx
mov ecx, dword [ebp - 0xf620]
push 0
lea edx, [ebp - 0xf7e4]
push edx
mov edx, dword [ebp - 0xf614]
push eax
mov eax, dword [edx*4 + 0x71de80]
push 0
push ecx
push esi
push eax
call dword [0x6e9100]
add esp, 0x28
mov dword [ebp - 0xf610], eax
cmp eax, 0xc0000010
jne 0x49813e
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x498070
xor ebx, ebx
jmp 0x4980e0
cmp ebx, dword [ebp - 0xf6b4]
jae 0x49813e
lea ecx, [ebp - 0xf6d8]
push ecx
lea edx, [ebp - 0xf710]
push edx
mov edx, dword [ebp - 0xf5f8]
lea eax, [ebp - 0xf628]
push eax
mov eax, dword [ebp - 0xf614]
push 0
lea ecx, [ebp - 0xf7e4]
push ecx
mov ecx, dword [eax*4 + 0x71de80]
push edx
push 0
push esi
push ecx
call dword [0x6e90fc]
add esp, 0x24
mov dword [ebp - 0xf610], eax
cmp eax, 0xc0000010
jne 0x49813e
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x4980e0
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea edx, [ebp - 0xf7bc]
push edx
call fcn.004dca10
mov dword [0x6e9088], 0
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [ebp - 0xf610]
mov esi, 1
cmp dword [ebp - 0xf728], esi
jne 0x498185
push 0x20
call fcn.004418a0
add esp, 4
cmp dword [ebp - 0xf6b0], esi
jne 0x498193
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [ebp - 0xf614]
imul esi, esi, 0xa00
cmp dword [esi + 0x71e8b0], 3
jne 0x4981b0
xor edi, edi
mov dword [ebp - 0xf610], edi
cmp byte [ebp - 0x14c0], 0
movzx ecx, byte [esi + 0x71e8bc]
mov dword [ebp - 0xf7ac], ecx
jne 0x4981df
cmp byte [esi + 0x71e004], 0
lea eax, [esi + 0x71e004]
je 0x4981df
push eax
lea edx, [ebp - 0x14c0]
push edx
call ebx
cmp byte [ebp - 0x1dd4], 0
jne 0x498201
cmp byte [esi + 0x71e108], 0
lea eax, [esi + 0x71e108]
je 0x498201
push eax
lea eax, [ebp - 0x1dd4]
push eax
call ebx
cmp byte [ebp - 0x1ed8], 0
jne 0x498223
cmp byte [esi + 0x71e20c], 0
lea eax, [esi + 0x71e20c]
je 0x498223
push eax
lea ecx, [ebp - 0x1ed8]
push ecx
call ebx
test edi, edi
je 0x498787
cmp edi, 0xc0000010
jg 0x498624
je 0x49860c
cmp edi, 0xc0000000
je 0x4985c1
cmp edi, 0xc0000001
jne 0x49863c
lea ecx, [ebp - 0x13bc]
push ecx
call fcn.005dfb23
add esp, 0x10
cmp dword [0x71de6c], 0
je 0x498778
xor esi, esi
cmp dword [ebp - 0xf6b0], esi
jne 0x498320
mov ebx, dword [ebp - 0xf614]
cmp esi, dword [ebp - 0xf6b4]
jae 0x498151
mov eax, dword [0x74126c]
push eax
lea ecx, [ebp - 0xf6d8]
push ecx
mov ecx, dword [ebp - 0xf5f4]
lea edx, [ebp - 0xf710]
push edx
mov edx, dword [ebx*4 + 0x71de80]
lea eax, [ebp - 0xf628]
push eax
push 0
push 0
push ecx
push edx
call dword [0x6e90f8]
add esp, 0x20
mov dword [ebp - 0xf610], eax
cmp eax, 0xc0000010
jne 0x498151
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
jmp 0x4982c0
cmp esi, dword [ebp - 0xf6b4]
jae 0x498151
push 0
lea eax, [ebp - 0xf6d8]
push eax
mov eax, dword [ebp - 0xf5f4]
lea ecx, [ebp - 0xf710]
push ecx
mov ecx, dword [ebp - 0xf614]
lea edx, [ebp - 0xf628]
push edx
mov edx, dword [ecx*4 + 0x71de80]
push 0
push 0
push eax
push edx
call dword [0x6e90f8]
add esp, 0x20
mov dword [ebp - 0xf610], eax
cmp eax, 0xc0000010
jne 0x498151
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
jmp 0x498320
mov eax, dword [ebp - 0xf620]
push eax
call fcn.005e3c47
mov esi, eax
add esp, 4
cmp esi, edi
je 0x49815b
mov dword [ebp - 0xf6a4], 5
mov dword [0x6e9088], 1
cmp dword [0x71de6c], edi
je 0x498464
mov ebx, dword [ebp - 0xf614]
mov edx, dword [ebx*4 + 0x71de80]
lea ecx, [ebp - 0xf7ec]
push ecx
push 0x1a
push edx
mov dword [ebp - 0xf7ec], edi
mov dword [ebp - 0xf7c4], edi
mov dword [ebp - 0xf7a8], edi
call dword [0x6e90e4]
mov ecx, dword [ebx*4 + 0x71de80]
add esp, 0xc
lea eax, [ebp - 0xf7c4]
push eax
push 0x1b
push ecx
call dword [0x6e90e4]
mov eax, dword [ebx*4 + 0x71de80]
add esp, 0xc
lea edx, [ebp - 0xf7a8]
push edx
push 0x57
push eax
call dword [0x6e90e4]
mov ecx, dword [ebp - 0xf7a8]
mov edx, dword [ebp - 0xf7c4]
mov eax, dword [ebp - 0xf7ec]
add esp, 0xc
push ecx
push edx
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x13bc]
push str.__s__Scan_Obj_by_Name__Arch_u__Eml_u__Deep_u_
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
lea esp, [esp]
cmp ebx, dword [ebp - 0xf6a4]
jae 0x498506
cmp dword [ebp - 0xf6b0], 0
push 0
jne 0x4984b8
mov edx, dword [0x74126c]
push edx
lea eax, [ebp - 0xf6d8]
push eax
mov eax, dword [ebp - 0xf614]
lea ecx, [ebp - 0xf710]
push ecx
mov ecx, dword [eax*4 + 0x71de80]
lea edx, [ebp - 0xf628]
push edx
push 0
push esi
push 0
push ecx
jmp 0x4984e2
push 0
lea edx, [ebp - 0xf6d8]
push edx
mov edx, dword [ebp - 0xf614]
lea eax, [ebp - 0xf710]
push eax
mov eax, dword [edx*4 + 0x71de80]
lea ecx, [ebp - 0xf628]
push ecx
push 0
push esi
push 0
push eax
call dword [0x6e90ec]
add esp, 0x24
mov dword [ebp - 0xf610], eax
cmp eax, 0xc0000010
jne 0x498506
mov eax, 0xc8
push eax
call edi
inc ebx
jmp 0x498470
push esi
mov dword [0x6e9088], 0
call fcn.005e0865
add esp, 4
jmp 0x49815b
cmp dword [0x71de6c], edi
je 0x49815b
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x13bc]
push str.__s__Scan_Obj___IGNORED
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push edi
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x49815b
mov ecx, dword [ebp - 0xf5f0]
mov edx, dword [ebp - 0xf614]
push 0xc0000000
push ecx
push edx
lea eax, [ebp - 0x13bc]
push str._SCAN__Error:_ScanAndCleanFile__d__Function_Fails_For_File___s_._Scan_Error:__x__SCAN_ERROR_FAILED_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
mov dword [ebp - 0xf708], 1
jmp 0x499e03
mov edx, dword [ebp - 0xf5f0]
mov eax, dword [ebp - 0xf614]
push edx
push eax
push str._SCAN__Error:_ScanAndCleanFile__d__Function_Fails_For_File___s_._Reason:_No_Memory__SCAN_ERROR_NO_MEMORY_
jmp 0x498268
cmp edi, 0xc000001d
je 0x498741
cmp edi, 0xc0001009
je 0x4986c5
push 0x103
lea ecx, [ebp - 0x2df3]
push 0
push ecx
mov byte [ebp - 0x2df4], 0
call fcn.005dfd60
lea edx, [ebp - 0x2df4]
push edx
push edi
call fcn.004a7390
add esp, 0x14
cmp byte [ebp - 0x2df4], 0
jne 0x49868c
mov edx, dword [ebp - 0xf5f0]
mov eax, dword [ebp - 0xf614]
push edx
push eax
lea ecx, [ebp - 0x13bc]
push str._SCAN__Error:_ScanAndCleanFile__d__Function_Fails_For_File___s_._Reason:_The_Current_Instance_Is_Already_Running_A_Scanning_Instance_Or_Enumeration_Operation__SCAN_ERROR_BUSY_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
mov eax, dword [0x7302fc]
inc eax
add esp, 0x20
mov dword [0x7302fc], eax
cmp eax, 0xa
jb 0x498778
mov eax, dword [ebp - 0xf5f0]
mov ecx, dword [ebp - 0xf614]
push eax
push ecx
lea edx, [ebp - 0x13bc]
push str._SCAN__Error:_ScanAndCleanFile__d__Function_Fails_For_File___s_._Reason:_Invalid_Path_Given_For_Scanning__SCAN_ERROR_PATH_ACCESS_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov dword [ebp - 0xf708], 1
jmp 0x499e03
cmp dword [0x71de6c], 0
je 0x498801
mov eax, dword [ebp - 0xf5f0]
cmp byte [eax], 0x5c
jne 0x4987af
cmp byte [eax + 1], 0x5c
jne 0x4987af
mov ecx, dword [str.NETSCAN]
mov edx, dword [0x639034]
jmp 0x4987bb
mov ecx, dword [str.LOCSCAN]
mov edx, dword [0x638fb0]
push eax
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x70], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xf6dc]
lea ecx, [ebp - 0x13bc]
push eax
lea eax, [ebp - 0x70]
push eax
push str.__s__Scan__Back_Into_Intercept:_u__Success:__s
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp byte [esi + 0x71e8bb], 1
jne 0x498851
cmp dword [0x71de6c], 0
mov dword [ebp - 0xf628], 3
je 0x49885a
lea ecx, [esi + 0x71df00]
push ecx
lea edx, [ebp - 0x13bc]
push str.FVS:_OBJECT_STATUS_INFECTED__VN___s
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp dword [ebp - 0xf628], 1
je 0x4988a1
cmp byte [esi + 0x71e8ba], 1
jne 0x4988a1
cmp dword [ebp - 0xf628], 0
jne 0x498903
cmp dword [0x71de6c], 0
je 0x499ea4
mov eax, dword [0x71de6c]
test eax, eax
je 0x49aadb
push 0
push eax
push str.UnicodeToAnsi_Failed._Exiting_Callback
jmp 0x49aace
cmp dword [0x6e91b8], edx
jne 0x49aa94
cmp dword [0x741164], ebx
jne 0x49aa94
push ebx
push 1
push str._MONITOR_SET_FOR_SKIP_ALL_SCANS_1_...
push 0x6aec98
mov dword [0x741164], 1
call fcn.004311c0
mov ecx, dword [0x71de6c]
mov eax, dword [0x685b84]
add esp, 0x10
cmp ecx, ebx
je 0x49aae0
cmp dword [0x6b07b0], ebx
je 0x49aabf
push ebx
push ecx
push str.Monitor_to_be_unloaded...
push 0x6aec98
call fcn.004311c0
mov ecx, dword [0x71de6c]
mov eax, dword [0x685b84]
add esp, 0x10
cmp dword [0x6b0760], ebx
je 0x49aae0
push ebx
push ecx
push str.Full_Signature_Load_Not_Complete_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x685b84]
mov dword [ebp - 0xf6d0], 1
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff4
add eax, 0xd
mov dword [ebp - 0xf608], eax
mov eax, dword [ebp - 0xf614]
cmp dword [eax*4 + 0x71de80], 0
mov dword [ebp - 4], 0x44
je 0x49abb9
cmp dword [ebp - 0xf624], 1
jne 0x49abb9
mov eax, dword [0x71de6c]
test eax, eax
je 0x49ab41
push 0
push eax
push str._ARCH__Resetting_back_OptScanArch...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov esi, dword [ebp - 0xf614]
mov ecx, dword [esi*4 + 0x71de80]
push 0
push 0x1a
push ecx
call dword [0x6e90e0]
mov edx, dword [esi*4 + 0x71de80]
add esp, 0xc
push 0
push 0x1b
push edx
call dword [0x6e90e0]
add esp, 0xc
cmp dword [0x6e91b4], 0
jne 0x49ab83
cmp dword [ebp - 0xf638], 0
je 0x49ab98
mov eax, dword [esi*4 + 0x71de80]
push 0
push 0x57
push eax
call dword [0x6e90e0]
add esp, 0xc
cmp dword [0x71de6c], 0
je 0x49abb9
mov ecx, dword [esi*4 + 0x71de80]
push 0
push 0xff0
push ecx
call dword [0x6e90e0]
add esp, 0xc
cmp dword [ebp - 0xf5f4], 0
je 0x49abe3
lea edx, [ebp - 0xf5f4]
push edx
call fcn.004dca10
cmp eax, 1
jne 0x49ad1b
mov eax, dword [ebp - 0xf7dc]
mov dword [eax], 0
mov eax, dword [ebp - 0xefac]
test eax, eax
je 0x49abf3
mov dword [eax], 1
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xf6d0], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp - 0xf6f0]
mov edi, dword [ebp - 0xf740]
mov ecx, 0xd
lea eax, [ecx - 0xc]
jne 0x49ac2b
cmp dword [ebp - 0xf608], ecx
jne 0x49ac2b
mov dword [ebp - 0xf608], eax
cmp dword [ebp - 0xf7ac], 0
je 0x49ac42
cmp dword [ebp - 0xf608], eax
jne 0x49ac42
mov dword [ebp - 0xf608], ecx
cmp dword [ebp - 0xf7b0], eax
jne 0x49ac50
mov dword [ebp - 0xf608], ecx
cmp dword [0x71de6c], 0
jne 0x49ac66
cmp dword [0x72be04], 0
je 0x49afb8
xor eax, eax
push 0x103
push eax
lea ecx, [ebp - 0x1fdb]
push ecx
mov byte [ebp - 0x64], 0
mov dword [ebp - 0x63], eax
mov dword [ebp - 0x5f], eax
mov dword [ebp - 0x5b], eax
mov dword [ebp - 0x57], eax
mov dword [ebp - 0x53], eax
mov dword [ebp - 0x4f], eax
mov dword [ebp - 0x4b], eax
mov word [ebp - 0x47], ax
mov byte [ebp - 0x45], al
mov byte [ebp - 0x1fdc], al
call fcn.005dfd60
mov eax, dword [ebp - 0xf608]
lea edx, [ebp - 0x1fdc]
push edx
push eax
call fcn.0045cfe0
fild dword [ebp - 0xf5f8]
mov edx, dword [ebp - 0xf5f8]
add esp, 0x14
lea ecx, [ebp - 0x64]
push ecx
test edx, edx
jge 0x49acd0
fadd qword [0x60ecc0]
sub esp, 8
fstp qword [esp]
call fcn.0045e4a0
add esp, 0xc
cmp dword [0x71de6c], 0
je 0x49ae82
test edi, edi
jbe 0x49ae30
cmp dword [ebp - 0xf6cc], 0
jne 0x49adea
call esi
sub eax, edi
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x1fdc]
push ecx
push ebx
push str.___d__Out_of_Flt_Clbk_4____s____s___u_ms_
jmp 0x49ae00
push 0x103
lea ecx, [ebp - 0x2ef7]
push 0
push ecx
mov byte [ebp - 0x2ef8], 0
call fcn.005dfd60
lea edx, [ebp - 0x2ef8]
push 0x104
push edx
call fcn.004d8c20
mov eax, dword [ebp - 0xf5f0]
add esp, 0x14
test eax, eax
je 0x49ad8e
cmp byte [eax], 0
je 0x49ad8e
lea ecx, [ebp - 0x2ef8]
push ecx
push eax
lea edx, [ebp - 0x4328]
push str.Unable_to_CloseHandle_for___s_.__s
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x4328]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x49abe3
lea ecx, [ebp - 0x2ef8]
push ecx
lea edx, [ebp - 0x4328]
push str.Unable_to_CloseHandle___s
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x4328]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x49abe3
call esi
sub eax, edi
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x1fdc]
push ecx
push ebx
push str.___d__Out_of_Flt_Clbk_4_SUEX____s____s___u_ms_
lea edx, [ebp - 0x13bc]
push edx
call fcn.005dfb23
mov eax, dword [0x71de6c]
add esp, 0x18
push 0
push eax
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49afb8
cmp dword [ebp - 0xf6cc], 0
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x1fdc]
push eax
lea ecx, [ebp - 0x13bc]
push ebx
jne 0x49ae52
push str.___d__Out_of_Flt_Clbk_4____s____s__Start_Time_unavailable_
jmp 0x49ae57
push str.___d__Out_of_Flt_Clbk_4_SUEX____s____s__Start_Time_unavailable_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
add esp, 0x14
push 0
push edx
lea eax, [ebp - 0x13bc]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x49afb8
cmp dword [ebp - 0xf5f0], 0
je 0x49afd5
cmp dword [ebp - 0xf6cc], 0
jne 0x49afb8
test edi, edi
jbe 0x49af7c
call esi
mov esi, eax
sub esi, edi
mov eax, dword [0x72be04]
jne 0x49aeba
cmp eax, 2
je 0x49afb8
cmp eax, 2
jbe 0x49aec7
cmp esi, eax
jb 0x49afb8
cmp eax, 0x64
jne 0x49af3d
cmp byte [0x741060], 0
jne 0x49af0f
push 0x741060
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x741060
call fcn.004e24e0
add esp, 4
push str.TFILE.BAT
push 0x741060
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x741060
call fcn.004e0670
add esp, 4
mov ecx, dword [ebp - 0xf5f0]
push ecx
lea edx, [ebp - 0xaa30]
push str._copy___s__b_NUL
push edx
call fcn.005dfb23
push 1
lea eax, [ebp - 0xaa30]
push eax
push 0x741060
call fcn.004e1620
add esp, 0x18
mov eax, dword [ebp - 0xf5f0]
push esi
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x1fdc]
push edx
push eax
push ebx
lea ecx, [ebp - 0x13bc]
push str.___d___s___s____s___u_ms_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x13bc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x2c
jmp 0x49afb8
mov edx, dword [ebp - 0xf5f0]
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x1fdc]
push ecx
push edx
push ebx
lea eax, [ebp - 0x13bc]
push str.___d___s___s____s__Start_Time_unavailable_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x13bc]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
mov eax, dword [ebp - 0xf5f0]
test eax, eax
je 0x49afd5
push eax
call fcn.005e0865
add esp, 4
mov dword [ebp - 0xf5f0], 0
mov eax, dword [ebp - 0xf644]
test eax, eax
je 0x49afe8
push eax
call fcn.004da940
add esp, 4
mov edx, dword [0x732b8c]
test edx, edx
jle 0x49b024
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0x732b8c
call esi
mov eax, dword [0x733104]
test eax, eax
je 0x49b024
cmp dword [ebp - 0xf798], 0
jne 0x49b024
mov eax, dword [eax + 4]
test eax, eax
jle 0x49b024
mov ecx, dword [0x733104]
add ecx, 4
push ecx
call esi
mov edx, dword [ebp - 0xf614]
mov eax, dword [ebp - 0xf608]
mov dword [edx*4 + 0x6e91fc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret