Function at 0x50db50
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f65ba
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x148
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x148], esi
lea ecx, [esi + 0x158]
call fcn.005dbeb0
test al, al
je 0x50dbaf
xor eax, eax
jmp 0x50ecab
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
push ecx
lea ecx, [ebp - 0x54]
movq qword [ebp - 0x54], xmm0
call fcn.005dc5b0
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov edi, eax
mov dword [ebp - 0x140], edi
test edi, edi
jne 0x50dc04
push eax
push 1
push 1
push eax
push 0x62794c
lea ecx, [ebp - 0x54]
call fcn.005daa70
test eax, eax
je 0x50dc04
mov al, 1
jmp 0x50dc06
xor al, al
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov byte [ebp - 0x139], al
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
test al, al
je 0x50de2c
push 0
push 0x62794c
lea ecx, [ebp - 0x54]
movq qword [ebp - 0x90], xmm0
movups xmmword [ebp - 0xa0], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0xa0]
call fcn.005d92a0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.005d9210
cmp eax, 2
jae 0x50dc86
call fcn.005d9280
xor esi, esi
jmp 0x50ec68
push 0
dec eax
lea ecx, [ebp - 0x20]
push eax
call fcn.004042f0
lea ecx, [ebp - 0xa0]
call fcn.005d9210
cmp eax, 1
jbe 0x50dd1b
xor edx, edx
mov esi, 1
mov dword [ebp - 0x30], edx
nop dword [eax]
mov ecx, dword [ebp - 0x20]
lea eax, [esi - 1]
mov edi, dword [ebp - 0x18]
cmp ecx, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
cmovbe ecx, esi
add edi, edx
push 0
push 0
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xa0]
push esi
call fcn.005d9220
push eax
push 0x624284
push 0
call fcn.005d9220
push eax
mov ecx, edi
call fcn.005dc200
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0xa0]
add edx, 0xc
inc esi
mov dword [ebp - 0x30], edx
call fcn.005d9210
cmp esi, eax
jb 0x50dcb0
mov esi, dword [ebp - 0x148]
mov edi, dword [ebp - 0x140]
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
call fcn.005d9280
test edi, edi
je 0x50de56
lea ecx, [ebp - 0x88]
call fcn.005d04b0
lea ecx, [esi + 0x11c]
call fcn.005dc400
xor ecx, ecx
call fcn.005d3930
test eax, eax
je 0x50dd5c
push eax
call fcn.0041e1c3
add esp, 4
push 0
mov ecx, esi
call fcn.0053a660
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 1
push dword [eax + 0x34]
call fcn.005b9910
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push str.Preparing_to_scan...
push dword [eax + 0x38]
call fcn.005bcd30
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push 0
push 0x1009
push dword [eax + 0xb8]
call fcn.005befd0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push 0
push 0x1009
push dword [eax + 0xb8]
call fcn.005befd0
lea ecx, [ebp - 0x88]
call fcn.005d0510
push edx
push eax
lea ecx, [esi + 0x140]
call fcn.005db3f0
sub esp, 0xc
lea ecx, [esi + 0x134]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Temp
call fcn.005dc190
push eax
lea ecx, [esi + 0x140]
call fcn.005da510
lea ecx, [esi + 0x140]
call fcn.005dc190
or edx, 0xffffffff
mov ecx, eax
call fcn.005e0f30
test al, al
jne 0x50de84
push 1
mov ecx, esi
call fcn.0053a660
mov esi, eax
jmp 0x50ec68
test edi, edi
jne 0x50dd32
push 1
push 1
lea ecx, [ebp - 0x20]
call fcn.004042f0
cmp dword [eax], edi
ja 0x50de4a
mov dword [eax], 1
lea ecx, [ebp - 0x54]
push ecx
mov ecx, dword [eax + 8]
call fcn.005dc4e0
mov eax, dword [ebp - 0x20]
mov ecx, 1
test eax, eax
cmove eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x50dd32
xor esi, esi
jmp 0x50ec68
lea ecx, [esi + 0x140]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, 2
lea ecx, [esi + 0x140]
push eax
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, esi
call fcn.0050db30
test al, al
je 0x50dec6
xor esi, esi
jmp 0x50ec68
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 3
push dword [eax + 0x34]
call fcn.005b9910
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push str.Updating_definitions...
push dword [eax + 0x38]
call fcn.005bcd30
cmp dword [esi + 0x10], 0
jne 0x50def8
mov ecx, esi
call fcn.00510420
cmp dword [esi + 0x10], 1
jne 0x50df1d
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.0050db30
test al, al
jne 0x50df94
push 0x64
call edi
cmp dword [esi + 0x10], 1
je 0x50df04
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 6
push dword [eax + 0x34]
call fcn.005b9910
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push str.Loading_definitions...
push dword [eax + 0x38]
call fcn.005bcd30
lea ecx, [ebp - 0x88]
call fcn.005d0510
ret
and eax, 0x5052000c
lea ecx, [esi + 0x33c]
call fcn.005db3f0
sub esp, 0xc
lea ecx, [esi + 0x33c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UAK_DB
call fcn.005da510
lea ecx, [esi + 0x33c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.00510220
test eax, eax
jne 0x50df9e
mov esi, 3
jmp 0x50ec68
sub esp, 0xc
lea ecx, [esi + 0x33c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.HKLM_
call fcn.005da510
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0xf
push dword [eax + 0x34]
call fcn.005b9910
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push str.Preparing_to_scan...
push dword [eax + 0x38]
call fcn.005bcd30
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
call fcn.005d6aa0
push 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x33c]
push 0x20019
mov dword [ebp - 0x3c], 0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005d6a80
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.005e17c0
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
lea ecx, [ebp - 0x94]
movq qword [ebp - 0x94], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xe0], 0
lea ecx, [ebp - 0xe8]
movq qword [ebp - 0xe8], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xd4], 0
lea ecx, [ebp - 0xdc]
movq qword [ebp - 0xdc], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 8
call fcn.005d0510
mov ecx, edx
mov dword [ebp - 0x154], eax
push ecx
mov dword [ebp - 0x14c], ecx
lea ecx, [ebp - 0xe8]
push eax
call fcn.005db3f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6674ec
lea ecx, [ebp - 0xe8]
call fcn.005dc190
push eax
push str.customScan
lea ecx, [esi + 0x134]
call fcn.005dc190
push eax
lea ecx, [esi + 0x11c]
call fcn.005dc200
xorps xmm0, xmm0
lea ecx, [ebp - 0x80]
movups xmmword [ebp - 0x80], xmm0
movups xmmword [ebp - 0x70], xmm0
call fcn.005e47e0
push 0
push 0x22
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 9
call fcn.005dc190
push eax
lea ecx, [ebp - 0x80]
call fcn.005e4120
test eax, eax
je 0x50e2dd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.scan_report__r_n_r_n
push 0
push 1
push 1
push 0
push str.threat
lea ecx, [esi + 0x354]
call fcn.005daa70
test eax, eax
mov edx, str.s_threat
mov ecx, 0x66ca88
cmove ecx, edx
push ecx
lea ecx, [esi + 0x354]
call fcn.005dc190
push eax
push 0x66754c
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push str.bits_._r_n
push 0x627dcc
push 0x62d7ec
push str.10.9.4.0
push str._version:
lea ecx, [esi + 0x354]
call fcn.005dc190
push eax
push 0x629bbc
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
push 0
push dword [esi + 0xc]
lea ecx, [ebp - 0xdc]
call fcn.005db3f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0xdc]
call fcn.005dc190
push eax
push str._definitions_database_number:
lea ecx, [esi + 0x354]
call fcn.005dc190
push eax
push 0x629bbc
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
cmp byte [ebp - 0x139], 0
je 0x50e254
mov eax, str._r_n_tOn_demand_multiple_file_threat_scan_r_n
jmp 0x50e274
cmp dword [ebp - 0x140], 0
jne 0x50e264
mov eax, str._r_n_tOn_demand_single_file_threat_scan_r_n
jmp 0x50e274
cmp byte [esi + 0x14], 0
mov eax, str._r_n_tOn_demand_recursive_directory_threat_scan_r_n
jne 0x50e274
mov eax, str._r_n_tOn_demand_directory_root_threat_scan_r_n
mov byte [ebp - 0x144], 1
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x144]
push eax
call fcn.005dc260
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x88]
call fcn.005d0520
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.._r_n_r_n
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push str._tScan_start_time:
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
lea ecx, [esi + 0x2f8]
call fcn.0050b370
lea ecx, [esi + 0x248]
call fcn.005ad750
push 0
lea ecx, [esi + 0x230]
call fcn.005ae7a0
push str.HKLM64SOFTWARECarifredVirusTotal_reports
lea ecx, [esi + 0x248]
call fcn.005ae3f0
push 1
lea ecx, [esi + 0x248]
call fcn.005ac9a0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x14
push dword [eax + 0x34]
call fcn.005b9910
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push str.Analyzing_files...
push dword [eax + 0x38]
call fcn.005bcd30
lea ecx, [ebp - 0x54]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x50e361
cmp byte [ebp - 0x139], al
je 0x50e76b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str...._r_n_r_n
lea ecx, [ebp - 0x54]
call fcn.005dc190
push eax
push str.__Scanning
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
cmp dword [ebp - 0x140], 0
je 0x50e4a3
cmp dword [ebp - 0x1c], 0x64
jae 0x50e47b
mov eax, dword [ebp - 0x18]
push 0x4b4
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x150], 0x64
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0x140], eax
push fcn.005dc430
push fcn.005dc5e0
mov byte [ebp - 4], 0xa
push 0x64
mov dword [eax], 0x64
add eax, 4
push 0xc
push eax
mov dword [ebp - 0x34], eax
call fcn.0041e804
mov eax, dword [ebp - 0x144]
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x50e474
cmp dword [ebp - 0x20], 0
jbe 0x50e444
xor edi, edi
xor esi, esi
nop dword [eax]
add eax, edi
add ecx, edi
push eax
call fcn.005dc4e0
mov eax, dword [ebp - 0x144]
inc esi
add edi, 0xc
cmp esi, dword [ebp - 0x20]
jae 0x50e43e
mov ecx, dword [ebp - 0x18]
jmp 0x50e420
mov esi, dword [ebp - 0x148]
push fcn.005dc430
lea edi, [eax - 4]
mov byte [ebp - 4], 0xb
push dword [edi]
push 0xc
push eax
call fcn.0041e45b
mov eax, dword [edi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push edi
call fcn.0041e1c8
add esp, 8
mov byte [ebp - 4], 9
mov dword [ebp - 0x1c], 0x64
movzx eax, byte [esi + 0x14]
lea ecx, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
call fcn.005dc190
push eax
mov ecx, esi
call fcn.0050ed50
test al, al
je 0x50e76b
xorps xmm0, xmm0
mov dword [ebp - 0xa4], 0
lea ecx, [ebp - 0xac]
movq qword [ebp - 0xac], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x60]
movq qword [ebp - 0x60], xmm0
call fcn.005dc5e0
push 0x4c
lea eax, [ebp - 0x138]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x138]
call fcn.005e9520
mov byte [ebp - 4], 0xe
xor edi, edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x144], edi
test eax, eax
je 0x50e732
xor edx, edx
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x150], edx
mov ecx, esi
call fcn.0050db30
test al, al
jne 0x50e732
mov eax, edx
mov ecx, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x34]
add eax, 0x1e
push eax
mov eax, dword [esi + 8]
push dword [eax + 0x34]
call fcn.005b9910
lea eax, [edi + 1]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x20], edi
ja 0x50e55b
mov dword [ebp - 0x20], eax
jmp 0x50e561
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x140]
add ecx, dword [ebp - 0x18]
push 0x630518
push 1
push ecx
call fcn.005dc0b0
push eax
lea ecx, [ebp - 0xac]
call fcn.005dc260
mov ecx, eax
call fcn.005dc4c0
test al, al
je 0x50e6d7
mov eax, dword [ebp - 0x20]
cmp eax, edi
mov ecx, dword [ebp - 0x140]
cmovbe eax, dword [ebp - 0x148]
add ecx, dword [ebp - 0x18]
push 0
mov dword [ebp - 0x20], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x138]
call fcn.005e93e0
test al, al
je 0x50e6d7
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x60]
cmp eax, edi
cmovbe eax, dword [ebp - 0x148]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x140]
push eax
call fcn.005dc4e0
cmp dword [ebp - 0x20], edi
ja 0x50e5f1
lea eax, [edi + 1]
mov dword [ebp - 0x20], eax
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x140]
add edi, ecx
push 1
push ecx
lea ecx, [ebp - 0x138]
call fcn.005e9390
push eax
mov ecx, edi
call fcn.005dc260
mov ecx, eax
call fcn.005dbeb0
test al, al
jne 0x50e706
lea ecx, [ebp - 0x138]
call fcn.005e9340
mov ecx, eax
call fcn.005d8c40
test eax, eax
je 0x50e6a8
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x20], eax
ja 0x50e646
inc eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x138]
add edi, dword [ebp - 0x140]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.005e9340
push eax
push 0x62438c
mov ecx, edi
call fcn.005da780
mov edi, dword [ebp - 0x144]
cmp dword [ebp - 0x20], edi
ja 0x50e68c
lea eax, [edi + 1]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x140]
lea edx, [esi + 0x1a8]
add ecx, dword [ebp - 0x18]
push 3
call fcn.005e88c0
test al, al
je 0x50e70c
jmp 0x50e6df
mov edi, dword [ebp - 0x144]
cmp dword [ebp - 0x20], edi
ja 0x50e6b9
lea eax, [edi + 1]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x140]
add ecx, dword [ebp - 0x18]
push 0
push 0
push 0x62439c
push 0x624388
call fcn.005da270
jmp 0x50e6df
lea ecx, [ebp - 0x60]
call fcn.005dc400
cmp dword [ebp - 0x20], edi
ja 0x50e6ea
lea eax, [edi + 1]
mov dword [ebp - 0x20], eax
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x60]
add edi, dword [ebp - 0x140]
push 0
call fcn.005dc190
push eax
push edi
mov ecx, esi
call fcn.00511450
mov edi, dword [ebp - 0x144]
mov edx, dword [ebp - 0x150]
inc edi
add dword [ebp - 0x140], 0xc
add edx, 0x46
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x150], edx
cmp edi, dword [ebp - 0x34]
jb 0x50e520
mov ecx, esi
call fcn.0050db30
test al, al
jne 0x50e74d
call fcn.00511b80
test al, al
je 0x50e74d
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x138]
call fcn.005e9080
lea ecx, [ebp - 0x60]
call fcn.005dc430
lea ecx, [ebp - 0xac]
call fcn.005dc430
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push 0
push 0x1004
push dword [eax + 0xb8]
mov dword [ebp - 0x148], 0
call fcn.005befd0
xorps xmm0, xmm0
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0xd0]
movq qword [ebp - 0xd0], xmm0
mov dword [ebp - 0xc8], 0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0xc4]
movq qword [ebp - 0xc4], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xb8]
movq qword [ebp - 0xb8], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x48]
movq qword [ebp - 0x48], xmm0
call fcn.005dc5e0
push 0
push str._tInfected_file_objects:_r_n
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x14
call fcn.005e37e0
xor edi, edi
cmp dword [ebp - 0x34], edi
jbe 0x50e942
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push edi
push dword [eax + 0xb8]
call fcn.005bb5c0
cmp eax, 0x51
jne 0x50e92e
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push edi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc1c0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 1
push edi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xd0]
call fcn.005dc1c0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 2
push edi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xc4]
call fcn.005dc1c0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 3
push edi
push dword [eax + 0xb8]
call fcn.005bb510
push eax
lea ecx, [ebp - 0xb8]
call fcn.005dc1c0
push 0
push 0
push 0
push str._r_n_t_tItem_state:_Checked_r_n
lea ecx, [ebp - 0xb8]
call fcn.005dc190
push eax
push str._r_n_t_tModified_in:
lea ecx, [ebp - 0xc4]
call fcn.005dc190
push eax
push str._r_n_t_tMalware_type:
lea ecx, [ebp - 0xd0]
call fcn.005dc190
push eax
push str._r_n_t_tThreat_level:
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push str._r_n_t_tPath:
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
jmp 0x50e934
mov eax, dword [ebp - 0x148]
inc edi
cmp edi, dword [ebp - 0x34]
jb 0x50e827
test eax, eax
jne 0x50e951
push 0
push str._r_n_t_tNo_threats_found
lea ecx, [ebp - 0x80]
call fcn.005e37e0
lea ecx, [ebp - 0x80]
call fcn.005e4670
test eax, eax
je 0x50eaa5
lea ecx, [ebp - 0x38]
call fcn.005d04b0
lea ecx, [ebp - 0x38]
call fcn.005d0510
sub eax, dword [ebp - 0x154]
mov edi, edx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x154], eax
sbb edi, dword [ebp - 0x14c]
call fcn.005d0520
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x667ad8
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push str._r_n_r_n__End_of_custom_scan_r_n_r_n_tScan_end_time:
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
push edi
push dword [ebp - 0x154]
lea ecx, [ebp - 0x2c]
call fcn.005cfb90
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.._r_n_r_n
mov ecx, esi
call fcn.0050db30
test al, al
mov edx, str.The_scan_completed_successfully
mov ecx, str.The_scan_was_cancelled_by_the_user
cmove ecx, edx
push ecx
push str.._r_n_r_n_t
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
push str._tScan_duration:
lea ecx, [ebp - 0x2c]
call fcn.005dc200
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
push 0
push str._r_n_End_of_report
lea ecx, [ebp - 0x80]
call fcn.005e37e0
lea ecx, [ebp - 0x80]
call fcn.005e4680
add eax, 0x26
lea ecx, [ebp - 0x2c]
mov edi, edx
mov dword [ebp - 0x14c], eax
adc edi, 0
push edi
push eax
call fcn.005db580
lea ecx, [ebp - 0x2c]
call fcn.005dc3a0
mov ecx, dword [ebp - 0x14c]
add eax, eax
add ecx, eax
adc edi, 0
push edi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.005db580
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x67346c
lea ecx, [ebp - 0x2c]
call fcn.005da780
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x80]
call fcn.005e3a10
jmp 0x50eab0
lea ecx, [esi + 0x11c]
call fcn.005dc400
lea ecx, [ebp - 0x30]
call fcn.005d5440
lea ecx, [ebp - 0x3c]
call fcn.005d5440
push 5
lea ecx, [esi + 0x33c]
call fcn.005dad50
lea ecx, [esi + 0x33c]
call fcn.005dc190
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x64
push dword [eax + 0x34]
call fcn.005b9910
push 0
mov ecx, esi
call fcn.0050db30
test al, al
mov edx, str.Scan_complete.
mov eax, dword [esi + 8]
mov ecx, str.Scan_aborted.
cmove ecx, edx
push ecx
mov ecx, dword [esi + 4]
push dword [eax + 0x38]
call fcn.005bcd30
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..LOG
lea ecx, [esi + 0x134]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
lea ecx, [ebp - 0x48]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..blf
lea ecx, [esi + 0x134]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
lea ecx, [ebp - 0x48]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..regtrans_ms
lea ecx, [esi + 0x134]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
lea ecx, [ebp - 0x48]
call fcn.005dc190
mov edx, 2
mov ecx, eax
call fcn.005e4c40
lea ecx, [esi + 0x248]
call fcn.005ad750
lea ecx, [ebp - 0x48]
xor esi, esi
call fcn.005dc430
lea ecx, [ebp - 0xb8]
call fcn.005dc430
lea ecx, [ebp - 0xc4]
call fcn.005dc430
lea ecx, [ebp - 0xd0]
call fcn.005dc430
lea ecx, [ebp - 0x78]
call fcn.005d9280
mov eax, dword [ebp - 0x80]
cmp eax, 0xffffffff
je 0x50ec2f
test eax, eax
je 0x50ec2f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xdc]
call fcn.005dc430
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0xe8]
call fcn.005dc430
lea ecx, [ebp - 0x94]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005d69e0
lea ecx, [ebp - 0x30]
call fcn.005d69e0
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x50eca1
push fcn.005dc430
mov byte [ebp - 4], 0x15
push dword [edi - 4]
push 0xc
push edi
call fcn.0041e45b
mov eax, dword [edi - 4]
lea edx, [edi - 4]
lea ecx, [eax + eax*2]
lea ecx, [ecx*4 + 4]
push ecx
push edx
call fcn.0041e1c8
add esp, 8
lea ecx, [ebp - 0x54]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret