Function at 0x48ce00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c3a5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.E:BT35d5b808_a97e_445c_95cc_a112af3c9a8dFreetools_srcMcEventsTrackerMcAnalyticsTracker.cpp
push str.McAnalyticsTracker::LogScanEventsToMosaicSystem
push 0x18e
push 3
lea ecx, [ebp - 0x10]
call fcn.00422770
mov dword [ebp - 4], 0
push str.McAnalyticsTracker::LogScanEventsToMosaicSystem
push dword [eax]
call fcn.004270d0
push str.___Event_Action_is_:
push eax
call fcn.00426d40
mov edi, dword [ebp + 8]
add esp, 0x10
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x48ce71
mov ecx, dword [edi]
push 0x5cb760
push ecx
push eax
call fcn.004270d0
add esp, 8
push eax
call fcn.00426d40
mov ebx, dword [ebp + 0xc]
add esp, 8
mov ecx, ebx
cmp dword [ebx + 0x14], 8
jb 0x48ce96
mov ecx, dword [ebx]
push ecx
push eax
call fcn.004270d0
add esp, 8
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
call fcn.004241f0
mov eax, dword [ebp - 0x10]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov edx, edi
cmp dword [edi + 0x14], 8
mov ecx, dword [edi + 0x10]
mov dword [ebp + 0xc], ecx
jb 0x48ced3
mov edx, dword [edi]
cmp ecx, 9
mov dword [ebp + 8], 9
mov eax, ecx
cmova eax, dword [ebp + 8]
push eax
push str.Scheduled
push edx
call fcn.0055ef66
add esp, 0xc
test eax, eax
jne 0x48dc6c
cmp dword [ebp + 0xc], 9
jb 0x48dc6c
ja 0x48dc6c
lea ecx, [esi + 0xc]
push ebx
call fcn.004a0290
mov eax, dword [eax]
add eax, 0xfffffffd
cmp eax, 0x56
ja case.0x48cf28.5
movzx eax, byte [eax + 0x48e6cc]
jmp dword [eax*4 + 0x48e690]
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 9
push str.Scheduled
mov dword [ebp - 4], 2
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0xe
push str.Scan_Completed
mov byte [ebp - 4], 4
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 6
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x20
push str.mssplus_scheduled_scan_completed
mov byte [ebp - 4], 8
call fcn.00425810
mov byte [ebp - 4], 7
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00490c50
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 9
push str.Scheduled
mov dword [ebp - 4], 9
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], esp
mov ecx, esp
xor eax, eax
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0xe
push str.Scan_Completed
mov byte [ebp - 4], 0xb
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0xd
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x2c
push str.mssplus_found_safeconnect_subscriptionstatus
mov byte [ebp - 4], 0xf
call fcn.00425810
mov byte [ebp - 4], 0xe
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004977f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 9
push str.Scheduled
mov dword [ebp - 4], 0x10
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x11
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0xe
push str.Scan_Cancelled
mov byte [ebp - 4], 0x12
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x14
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x20
push str.mssplus_scheduled_scan_cancelled
mov byte [ebp - 4], 0x16
call fcn.00425810
mov byte [ebp - 4], 0x15
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004921c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0xb
push str.WiFi_Prompt
mov dword [ebp - 4], 0x17
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x16
push str.Unsecure_WiFi_Detected
mov byte [ebp - 4], 0x19
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x1b
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x1c
push str.mssplus_unsecure_wifi_prompt
mov byte [ebp - 4], 0x1d
call fcn.00425810
mov byte [ebp - 4], 0x1c
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00496e20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x16
push str.Windows_Defender_Alert
mov dword [ebp - 4], 0x1e
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x1f
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x18
push str.Basic_AV_System_Detected
mov byte [ebp - 4], 0x20
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x22
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x16
push str.mssplus_wd_alert_shown
mov byte [ebp - 4], 0x24
call fcn.00425810
mov byte [ebp - 4], 0x23
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00497eb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0xf
push str.Messaging_Alert
mov dword [ebp - 4], 0x25
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x26
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x15
push str.Messaging_Alert_Shown
mov byte [ebp - 4], 0x27
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x29
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x1d
push str.mssplus_messaging_alert_shown
mov byte [ebp - 4], 0x2b
call fcn.00425810
mov byte [ebp - 4], 0x2a
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00498440
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 9
push str.NGM_Alert
mov dword [ebp - 4], 0x2c
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x2d
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0xf
push str.NGM_Alert_Shown
mov byte [ebp - 4], 0x2e
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x30
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x17
push str.mssplus_ngm_alert_shown
mov byte [ebp - 4], 0x32
call fcn.00425810
mov byte [ebp - 4], 0x31
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004989d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 9
push str.NGM_Alert
mov dword [ebp - 4], 0x33
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x34
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x16
push str.NGM_Alert_Shown_Failed
mov byte [ebp - 4], 0x35
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x37
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x1e
push str.mssplus_ngm_alert_shown_failed
mov byte [ebp - 4], 0x39
call fcn.00425810
mov byte [ebp - 4], 0x38
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00499120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x1b
push str.NGM_Alert_Environment_Check
mov dword [ebp - 4], 0x3a
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x3b
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x19
push str.Environment_Checks_Passed
mov byte [ebp - 4], 0x3c
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x3e
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x21
push str.mssplus_ngm_alert_envcheck_passed
mov byte [ebp - 4], 0x40
call fcn.00425810
mov byte [ebp - 4], 0x3f
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00499a40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x1b
push str.NGM_Alert_Environment_Check
mov dword [ebp - 4], 0x41
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x42
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x19
push str.Environment_Checks_Failed
mov byte [ebp - 4], 0x43
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x45
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x21
push str.mssplus_ngm_alert_envcheck_failed
mov byte [ebp - 4], 0x47
call fcn.00425810
mov byte [ebp - 4], 0x46
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00499a40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0xa
push str.Virus_Scan
mov dword [ebp - 4], 0x48
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x49
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x12
push str.Virus_Scan_Started
mov byte [ebp - 4], 0x4a
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x4c
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x1a
push str.mssplus_virus_scan_started
mov byte [ebp - 4], 0x4e
call fcn.00425810
mov byte [ebp - 4], 0x4d
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00499fa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0xa
push str.Virus_Scan
mov dword [ebp - 4], 0x4f
call fcn.00425810
sub esp, 0x18
mov dword [ebp - 4], 0x50
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x14
push str.Virus_Scan_Completed
mov byte [ebp - 4], 0x51
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 4
push str.Scan
mov byte [ebp - 4], 0x53
call fcn.00425810
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x1c
push eax
push str.mssplus_virus_scan_completed
mov byte [ebp - 4], 0x55
call fcn.00471f80
mov byte [ebp - 4], 0x54
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0049a320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.Virus_Scan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x56
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Virus_Scan_Failed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x57
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x58
mov ecx, esp
push str.mssplus_virus_scan_failed
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0049ac70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.GreenB_Without_VPN_Migration
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x59
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.GreenB_Migration
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x5a
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x5b
mov ecx, esp
push str.mssplus_greenb_wovpn_to_yellow_migration
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0049b1d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.Scheduled
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x5c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.TokenGenFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x5d
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x5e
mov ecx, esp
push str.mssplus_token_gen_failed
jmp 0x48e3f7
push str.E:BT35d5b808_a97e_445c_95cc_a112af3c9a8dFreetools_srcMcEventsTrackerMcAnalyticsTracker.cpp
push str.McAnalyticsTracker::LogScanEventsToMosaicSystem
push 0x1bf
push 3
lea ecx, [ebp + 8]
call fcn.00422770
mov dword [ebp - 4], 0x5f
push str.No_event_label_found_for_scheduled_scan
push dword [eax]
call fcn.00426d40
lea ecx, [ebp + 8]
jmp 0x48e673
push str.Manual
mov ecx, edi
call fcn.004891d0
test eax, eax
jne 0x48de1b
lea ecx, [esi + 0xc]
push ebx
call fcn.004a0290
mov eax, dword [eax]
sub eax, 3
je 0x48dd43
sub eax, 1
je 0x48dccd
push str.E:BT35d5b808_a97e_445c_95cc_a112af3c9a8dFreetools_srcMcEventsTrackerMcAnalyticsTracker.cpp
push str.McAnalyticsTracker::LogScanEventsToMosaicSystem
push 0x1d0
push 3
lea ecx, [ebp + 8]
call fcn.00422770
mov dword [ebp - 4], 0x69
push str.No_event_label_found_for_manual_scan
push dword [eax]
call fcn.00426d40
lea ecx, [ebp + 8]
jmp 0x48e673
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.Manual
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x66
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Scan_Cancelled
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x67
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x68
mov ecx, esp
push str.mssplus_manual_scan_cancelled
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004921c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.Manual
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x60
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Scan_Completed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x61
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x62
mov ecx, esp
push str.mssplus_manual_scan_completed
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00490c50
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.Manual
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x63
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Scan_Completed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x64
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x65
mov ecx, esp
push str.mssplus_found_safeconnect_subscriptionstatus
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004977f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.PCOptScheduledScan
mov ecx, edi
call fcn.004891d0
test eax, eax
jne 0x48e27d
lea ecx, [esi + 0xc]
push ebx
call fcn.004a0290
mov eax, dword [eax]
add eax, 0xffffffc1
cmp eax, 0xa
ja case.default.0x48de46
jmp dword [eax*4 + 0x48e724]
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x6a
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptScanFlowLaunched
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x6b
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x6c
mov ecx, esp
push str.mssplus_pcopt_flow_launched
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0049b550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x6d
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptScanPreCondFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x6e
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x6f
mov ecx, esp
push str.mssplus_pcopt_precondition_failed
jmp 0x48de9c
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x70
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptScanInitFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x71
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x72
mov ecx, esp
push str.mssplus_pcopt_scan_init_failed
jmp 0x48de9c
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x73
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptScanStarted
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x74
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x75
mov ecx, esp
push str.mssplus_pcopt_scan_started
jmp 0x48de9c
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x76
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptScanFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x77
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x78
mov ecx, esp
push str.mssplus_pcopt_scan_failed
jmp 0x48de9c
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x79
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptScanCompleted
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x7a
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x7b
mov ecx, esp
push str.mssplus_pcopt_scan_completed
jmp 0x48de9c
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x7c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptFetchScanResultStarted
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x7d
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x7e
mov ecx, esp
push str.mssplus_pcopt_fetchscanresult_started
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0049bd30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x7f
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptFetchScanResultFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x80
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x81
mov ecx, esp
push str.mssplus_pcopt_fetchscanresult_failed
jmp 0x48e0b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x82
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptFetchScanResultCompleted
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x83
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x84
mov ecx, esp
push str.mssplus_pcopt_fetchscanresult_completed
jmp 0x48e0b3
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x85
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptScanResultShown
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x86
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x87
mov ecx, esp
push str.mssplus_pcopt_scanresults_shown
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0049c440
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.PCOptScheduledScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x88
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PCOptScanResultShownFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x89
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x8a
mov ecx, esp
push str.mssplus_pcopt_scanresults_shown_failed
jmp 0x48e0b3
push str.E:BT35d5b808_a97e_445c_95cc_a112af3c9a8dFreetools_srcMcEventsTrackerMcAnalyticsTracker.cpp
push str.McAnalyticsTracker::LogScanEventsToMosaicSystem
push 0x1fa
push 3
lea ecx, [ebp + 8]
call fcn.00422770
mov dword [ebp - 4], 0x8b
push str.No_event_label_found_for_pcoptimizer_scan
push dword [eax]
call fcn.00426d40
lea ecx, [ebp + 8]
jmp 0x48e673
push str.DarkWebScan
mov ecx, edi
call fcn.004891d0
test eax, eax
jne 0x48e41e
lea ecx, [esi + 0xc]
push ebx
call fcn.004a0290
mov eax, dword [eax]
add eax, 0xffffffac
cmp eax, 6
ja case.0x48e2a8.87
jmp dword [eax*4 + 0x48e750]
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.DarkWebScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x8c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.DarkWebScanStarted
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x8d
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x8e
mov ecx, esp
push str.mssplus_dwsscan_started
jmp 0x48e3f7
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.DarkWebScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x8f
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.DarkWebScanCompleted
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x90
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x91
mov ecx, esp
push str.mssplus_dwsscan_completed
jmp 0x48e3f7
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.DarkWebScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x92
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.DarkWebScanFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x93
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x94
mov ecx, esp
push str.mssplus_dwsscan_failed
jmp 0x48e3f7
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.DarkWebScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x95
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.DarkWebScanDrawerShown
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x96
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x97
mov ecx, esp
push str.mssplus_dws_drawer_shown
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0049dad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x612d78
mov ecx, edi
call fcn.004a0570
test eax, eax
jne 0x48e644
lea ecx, [esi + 0xc]
push ebx
call fcn.004a0290
mov eax, dword [eax]
add eax, 0xffffff99
cmp eax, 4
ja case.default.0x48e449
jmp dword [eax*4 + 0x48e76c]
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.AntitrackScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x98
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.AntitrackScanStarted
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x99
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x9a
mov ecx, esp
push str.mssplus_antitrack_scan_started
call fcn.00471f00
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0049f6e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.AntitrackScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x9b
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.AntitrackScanCompleted
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x9c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x9d
mov ecx, esp
push str.mssplus_antitrack_scan_completed
jmp 0x48e49f
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.AntitrackScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0x9e
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.AntitrackScanFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0x9f
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0xa0
mov ecx, esp
push str.mssplus_antitrack_scan_failed
jmp 0x48e49f
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.AntitrackScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0xa1
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.AntitrackScanResultsShown
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0xa2
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0xa3
mov ecx, esp
push str.mssplus_antitrack_scanresults_shown
jmp 0x48e49f
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.AntitrackScan
call fcn.00471f00
sub esp, 0x18
mov dword [ebp - 4], 0xa4
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.AntitrackScanResultsShownFailed
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0xa5
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Scan
call fcn.00471f00
sub esp, 0x18
mov byte [ebp - 4], 0xa6
mov ecx, esp
push str.mssplus_antitrack_scanresults_shown_failed
jmp 0x48e49f
push str.E:BT35d5b808_a97e_445c_95cc_a112af3c9a8dFreetools_srcMcEventsTrackerMcAnalyticsTracker.cpp
push str.McAnalyticsTracker::LogScanEventsToMosaicSystem
push 0x224
push 3
lea ecx, [ebp + 8]
call fcn.00422770
mov dword [ebp - 4], 0xa7
push str.No_event_label_found_for_pcoptimizer_scan
push dword [eax]
call fcn.00426d40
lea ecx, [ebp + 8]
jmp 0x48e673
push str.E:BT35d5b808_a97e_445c_95cc_a112af3c9a8dFreetools_srcMcEventsTrackerMcAnalyticsTracker.cpp
push str.McAnalyticsTracker::LogScanEventsToMosaicSystem
push 0x22a
push 3
lea ecx, [ebp + 0xc]
call fcn.00422770
mov dword [ebp - 4], 0xa8
push str.No_Event_Action_for_Scan_Category
push dword [eax]
call fcn.00426d40
lea ecx, [ebp + 0xc]
add esp, 8
call fcn.004227f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8