Function at 0x85f870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb15ad0
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], eax
mov ebx, 1
cmp dword [0xb5659c], ebx
je 0x85fd4d
cmp dword [0xb45d94], eax
je 0x85fa92
xor edi, edi
mov ecx, str.econceal
call fcn.009620b0
mov esi, eax
mov ecx, str.econservice
call fcn.009620b0
mov edi, eax
test esi, esi
je 0x85f917
test edi, edi
je 0x85f917
push 0
push 0
push 0x877690
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1d
call fcn.0085df70
jmp 0x85fa05
call fcn.00968790
test eax, eax
jne 0x85fa05
call fcn.00968c50
cmp eax, ebx
jne 0x85fa05
mov dword [ebp - 0x134], 0
call fcn.009687b0
test eax, eax
jne 0x85f959
call fcn.00968840
test eax, eax
jne 0x85f959
mov dword [ebp - 0x134], 2
jmp 0x85f974
lea eax, [ebp - 0x134]
push eax
push str.FirewallDriverChecked
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x134], 2
jae 0x85f989
test esi, esi
jne 0x85fa05
test edi, edi
jne 0x85fa05
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x12c]
push ecx
push str.FWDeRegistered
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
lea edx, [ebp - 0x130]
push edx
push str.FirewallRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x130], 0
jne 0x85f9fb
cmp dword [ebp - 0x12c], 0
jne 0x85fa05
mov dword [ebp - 0x12c], ebx
mov eax, ebx
mov esi, str.FWDeRegistered
mov ebx, str.SoftwareMicroWorld
mov ecx, 0x80000002
call fcn.0094be90
mov ecx, 0xb55508
call 0x9ce9e0
lea eax, [ebp - 0x12c]
push eax
push str.SOFTWAREMicroWorldeScan_for_WindowsODS
push 0x80000002
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call esi
test eax, eax
jne 0x85fa2f
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x12c]
push edx
push str.SOFTWAREMicroWorldeScan_for_WindowsBackup
push 0x80000002
call esi
test eax, eax
jne 0x85fa53
mov eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0x877a80
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1e
call fcn.0085df70
push ebx
push ebx
push 0x877c70
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1f
call fcn.0085df70
mov ebx, 1
call fcn.00a5bee0
test eax, eax
je 0x85fb3f
mov dword [0xb45b64], ebx
push 0
push 0
push 0x8758e0
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1g
call fcn.0085df70
push ebx
push ebx
push 0x875430
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1g_A
call fcn.0085df70
push ebx
push ebx
push 0x876c40
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1h
call fcn.0085df70
call fcn.0098f550
test eax, eax
jne 0x85fb49
lea ecx, [ebp - 0x130]
push ecx
push str.ESStart
mov ecx, str.SYSTEMCurrentControlSetServicesUSBSTOR
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x85fb49
push ebx
push ebx
push 0x877330
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1j
call fcn.0085df70
jmp 0x85fb49
mov dword [0xb45b64], 0
cmp dword [0xb45d94], 0
je 0x85fb57
call fcn.008805d0
push 0
push 0
push 0x878460
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1k
call fcn.0085df70
push ebx
push ebx
push 0x874ff0
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1m
call fcn.0085df70
push ebx
push ebx
push 0x873e50
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1mt
call fcn.0085df70
push ebx
push ebx
push 0x872bc0
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1n
call fcn.0085df70
push ebx
push ebx
push 0x873440
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1p
call fcn.0085df70
push ebx
push ebx
push 0x85f190
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1q
call fcn.0085df70
cmp dword [0xb45d94], ebx
je 0x85fc72
call fcn.00968f30
test al, al
jne 0x85fc17
call fcn.009685a0
test eax, eax
je 0x85fc72
mov esi, 1
mov dword [0xb567f0], esi
lea edx, [ebp - 0x138]
push edx
push str.SafeModeLocked
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x138], esi
jne 0x85fc72
cmp dword [0xb567f4], 0
jne 0x85fc72
call fcn.009751a0
push 0
push 0
push 0x873710
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1r
call fcn.0085df70
cmp dword [0xb54194], 0
je 0x85fcce
mov byte [ebp - 0x128], 0
push 0x103
push 0
lea eax, [ebp - 0x127]
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x128]
push ecx
push 0xaa1543
mov edx, str.server
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x128], 0x30
jne 0x85fcce
mov dword [0xb567f8], 1
push 0
push 0
push 0x8709b0
call fcn.00a791b2
add esp, 0xc
xor ebx, ebx
mov esi, eax
mov edi, str.AVM_1s
call fcn.0085df70
cmp dword [0xb5681c], ebx
jne 0x85fd4d
push ebx
push ebx
push 0x878120
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1t
call fcn.0085df70
cmp dword [0xb45d94], ebx
je 0x85fd4d
push ebx
push ebx
push 0x877e60
call fcn.00a791b2
add esp, 0xc
mov esi, eax
mov edi, str.AVM_1u
call fcn.0085df70
jmp 0x85fd4d
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret