Function at 0x47f3c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670b58
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x10eec
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10e78], ebx
xor edi, edi
mov dword [ebp - 0x10eec], edi
mov dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 0x10ea4], esi
mov byte [ebp - 0x10e68], 0
push 0xf9ff
push edi
lea eax, [ebp - 0x10e67]
push eax
call fcn.005dfd60
mov dword [ebp - 0x10e7c], edi
mov byte [ebp - 0x12c], 0
push 0x103
push edi
lea ecx, [ebp - 0x12b]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x10efc], edi
mov byte [ebp - 0x438], 0
push 0x103
push edi
lea edx, [ebp - 0x437]
push edx
call fcn.005dfd60
add esp, 0x24
push 0x6af4b8
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x12c]
push ecx
call fcn.004e24e0
add esp, 4
push str.eSetting.INI
lea edx, [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6e9080], eax
cmp byte [0x6e9268], 0
je 0x4815d4
push edi
push 1
push str.Reading_Configuration_File._Config_File_Mutex_Getting_Locked
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6e9250], edi
je 0x47f4f3
push 0x6e9250
call fcn.004da810
add esp, 4
mov esi, eax
mov dword [ebp - 0x10ea4], esi
cmp esi, 1
jne 0x48159f
push esi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x12c]
push eax
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x47f5a9
lea ecx, [ebp - 0x12c]
push ecx
push 0x104
lea edx, [ebp - 0x438]
push edx
push 0x60c81c
push str.ESettingProcessed
push str.FileAV
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x438], 0x31
je 0x47f5a9
lea eax, [ebp - 0x12c]
push eax
push 0x615678
push str.ESettingProcessed
push str.FileAV
call fcn.004e0cb0
push 0x6e9268
call fcn.004e0670
add esp, 0x14
mov dword [ebp - 0x10efc], esi
push edi
push esi
push str.PROCESSING_ESETTING.INI...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push edi
push edi
push edi
push edi
push 0x6e9268
call fcn.004ec5a0
add esp, 0x14
test eax, eax
je 0x47f5b2
lea ecx, [ebp - 0x12c]
push ecx
jmp 0x47f5cd
mov byte [ebp - 0x12c], 0
jmp 0x47f58b
push 0x6e9268
call fcn.004e8b10
add esp, 4
cmp eax, 0x33fb8
jae 0x47f5d5
lea edx, [ebp - 0x12c]
push edx
call fcn.00451ca0
add esp, 4
push ebx
call fcn.00452980
add esp, 4
mov esi, eax
mov dword [ebp - 0x10ea4], esi
cmp esi, edi
je 0x48153e
push edi
push 4
push edi
push str.DisableNetworkScan
call fcn.00430300
add esp, 0x10
cmp eax, 1
jne 0x47f67a
cmp dword [0x6e989c], edi
je 0x47f67a
mov dword [ebp - 0x10ee8], edi
lea eax, [ebp - 0x10ee8]
push eax
push str.NWScanSetInKlr
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47f67a
mov dword [ebp - 0x10ee8], 1
push 1
push str.NWScanSetInKlr
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x33fb8
push edi
push ebx
call fcn.005dfd60
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00451ca0
push ebx
call fcn.00452980
add esp, 0x14
mov esi, eax
mov dword [ebp - 0x10ea4], esi
cmp esi, edi
je 0x48153e
mov eax, dword [ebx]
mov dword [0x6e914c], eax
cmp eax, 3
jne 0x47f696
mov eax, dword [ebx + 8]
mov dword [0x6e914c], eax
mov edi, 0xa
cmp eax, 1
jne 0x47f6a7
mov dword [0x6e9150], eax
jmp 0x47f6f4
cmp eax, 2
jne 0x47f6b8
mov dword [0x6e9150], 1
jmp 0x47f6f4
cmp eax, 6
jne 0x47f6c9
mov dword [0x6e9150], 1
jmp 0x47f6f4
cmp eax, 4
jne 0x47f6d6
mov dword [0x6e9150], edi
jmp 0x47f6f4
cmp eax, 7
jne 0x47f6e3
mov dword [0x6e9150], edi
jmp 0x47f6f4
sub eax, 3
neg eax
sbb eax, eax
and eax, 0xfffffff7
add eax, edi
mov dword [0x6e9150], eax
push 0
push 4
push 0
push str.ScanTimeoutSeconds
call fcn.00430300
add esp, 0x10
mov dword [0x685b94], eax
test eax, eax
jne 0x47f716
mov dword [0x685b94], edi
xor edx, edx
mov eax, 2
cmp dword [ebx + 0x33f74], eax
sete dl
mov dword [0x6e8ce0], edx
mov dword [0x6e8c6c], 0
cmp dword [0x6ae138], 9
jae 0x47fb89
cmp dword [ebx + 0x33f70], 0
je 0x47f8b0
cmp dword [ebx + 0x33f74], eax
jne 0x47f8b0
mov dword [0x6e8c6c], 0x20400
mov dword [0x71de78], 1
xor esi, esi
mov dword [ebp - 0x10ef0], esi
cmp esi, 0xb
jge 0x47f99b
cmp dword [esi*4 + 0x71de80], 0
je 0x47f8aa
cmp dword [0x71de6c], 0
je 0x47f7e1
mov byte [ebp - 0x640], 0
push 0x103
push 0
lea eax, [ebp - 0x63f]
push eax
call fcn.005dfd60
push esi
push str._ARCH___b__SETTING_Archive_Scan_on_ScanInstance__d_
lea ecx, [ebp - 0x640]
push ecx
call fcn.005dfb23
push 0
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x640]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x28
push 1
push 0x1a
mov ecx, dword [esi*4 + 0x71de80]
push ecx
call dword [0x6e90e0]
push 1
push 0x1b
mov edx, dword [esi*4 + 0x71de80]
push edx
call dword [0x6e90e0]
push 1
push 0xff0
mov eax, dword [esi*4 + 0x71de80]
push eax
call dword [0x6e90e0]
mov ecx, dword [0x685bc0]
push ecx
push 0x28
mov edx, dword [esi*4 + 0x71de80]
push edx
call dword [0x6e90e0]
push 1
push 0x1a
mov eax, dword [esi*4 + 0x71deac]
push eax
call dword [0x6e90e0]
push 1
push 0x1b
mov ecx, dword [esi*4 + 0x71deac]
push ecx
call dword [0x6e90e0]
add esp, 0x48
push 1
push 0xff0
mov edx, dword [esi*4 + 0x71deac]
push edx
call dword [0x6e90e0]
mov eax, dword [0x685bc0]
push eax
push 0x28
mov ecx, dword [esi*4 + 0x71deac]
push ecx
call dword [0x6e90e0]
push 1
push 0x57
mov edx, dword [esi*4 + 0x71de80]
push edx
call dword [0x6e90e0]
push 1
push 0x57
mov eax, dword [esi*4 + 0x71deac]
push eax
call dword [0x6e90e0]
add esp, 0x30
inc esi
jmp 0x47f772
xor esi, esi
mov dword [0x71de78], esi
mov dword [ebp - 0x10f04], esi
cmp esi, 0xb
jge 0x47f99b
cmp dword [esi*4 + 0x71de80], 0
je 0x47f995
cmp dword [0x71de6c], 0
je 0x47f926
mov byte [ebp - 0x53c], 0
push 0x103
push 0
lea ecx, [ebp - 0x53b]
push ecx
call fcn.005dfd60
push esi
push str._ARCH___b__RESETTING_Archive_Scan_on_ScanInstance__d_
lea edx, [ebp - 0x53c]
push edx
call fcn.005dfb23
push 0
mov eax, dword [0x71de6c]
push eax
lea ecx, [ebp - 0x53c]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
push 0
push 0x1a
mov edx, dword [esi*4 + 0x71de80]
push edx
call dword [0x6e90e0]
push 0
push 0x1a
mov eax, dword [esi*4 + 0x71deac]
push eax
call dword [0x6e90e0]
push 0
push 0x1b
mov ecx, dword [esi*4 + 0x71de80]
push ecx
call dword [0x6e90e0]
push 0
push 0x1b
mov edx, dword [esi*4 + 0x71deac]
push edx
call dword [0x6e90e0]
push 0
push 0x57
mov eax, dword [esi*4 + 0x71de80]
push eax
call dword [0x6e90e0]
push 0
push 0x57
mov ecx, dword [esi*4 + 0x71deac]
push ecx
call dword [0x6e90e0]
add esp, 0x48
inc esi
jmp 0x47f8b8
xor esi, esi
cmp dword [ebx + 0x33f70], esi
je 0x47faa6
cmp dword [ebx + 0x33f78], esi
je 0x47faa6
add dword [0x6e8c6c], 0x10000
mov dword [0x71de7c], 1
mov dword [ebp - 0x10ef8], esi
cmp esi, 0xb
jge 0x47fb89
mov eax, dword [esi*4 + 0x71de80]
test eax, eax
je 0x47faa0
cmp dword [0x72bdf8], 0
je 0x47f9f4
push 1
jmp 0x47f9f6
push 0
push 0xfee
push eax
call dword [0x6e90e0]
add esp, 0xc
push 1
push 0x1771
mov edx, dword [esi*4 + 0x71de80]
push edx
call dword [0x6e90e0]
push 1
push 0x1771
mov eax, dword [esi*4 + 0x71deac]
push eax
call dword [0x6e90e0]
push 1
push 0x19
mov ecx, dword [esi*4 + 0x71de80]
push ecx
call dword [0x6e90e0]
push 1
push 0x19
mov edx, dword [esi*4 + 0x71deac]
push edx
call dword [0x6e90e0]
push 0
push 0x6b
mov eax, dword [esi*4 + 0x71de80]
push eax
call dword [0x6e90e0]
add esp, 0x3c
cmp dword [0x6e9150], edi
jne 0x47fa8b
push 1
push 0x6b
mov ecx, dword [esi*4 + 0x71deac]
push ecx
call dword [0x6e90e0]
add esp, 0xc
inc esi
jmp 0x47f9c9
push 0
push 0x6b
mov edx, dword [esi*4 + 0x71deac]
push edx
call dword [0x6e90e0]
add esp, 0xc
inc esi
jmp 0x47f9c9
mov dword [0x71de7c], esi
mov dword [ebp - 0x10f00], esi
cmp esi, 0xb
jge 0x47fb89
mov eax, dword [esi*4 + 0x71de80]
test eax, eax
je 0x47fb83
cmp dword [0x72bdf8], 0
je 0x47fad7
push 1
jmp 0x47fad9
push 0
push 0xfee
push eax
call dword [0x6e90e0]
add esp, 0xc
push 1
push 0x1771
mov eax, dword [esi*4 + 0x71de80]
push eax
call dword [0x6e90e0]
push 1
push 0x1771
mov ecx, dword [esi*4 + 0x71deac]
push ecx
call dword [0x6e90e0]
push 0
push 0x19
mov edx, dword [esi*4 + 0x71de80]
push edx
call dword [0x6e90e0]
push 0
push 0x19
mov eax, dword [esi*4 + 0x71deac]
push eax
call dword [0x6e90e0]
push 0
push 0x6b
mov ecx, dword [esi*4 + 0x71de80]
push ecx
call dword [0x6e90e0]
add esp, 0x3c
cmp dword [0x6e9150], edi
jne 0x47fb6e
push 1
push 0x6b
mov edx, dword [esi*4 + 0x71deac]
push edx
call dword [0x6e90e0]
add esp, 0xc
inc esi
jmp 0x47faac
push 0
push 0x6b
mov eax, dword [esi*4 + 0x71deac]
push eax
call dword [0x6e90e0]
add esp, 0xc
inc esi
jmp 0x47faac
xor esi, esi
mov dword [ebp - 0x10e74], esi
mov dword [ebp - 0x10e6c], esi
mov dword [ebp - 0x10eb0], esi
mov dword [ebp - 0x10ea8], esi
mov dword [ebp - 0x10ea0], esi
mov dword [ebp - 0x10e98], esi
xor ebx, ebx
mov dword [ebp - 0x10ee4], ebx
mov dword [ebp - 0x10ed8], esi
mov dword [ebp - 0x10ed0], esi
mov dword [ebp - 0x10ec8], esi
mov dword [ebp - 0x10ec0], esi
mov dword [ebp - 0x10eb8], esi
mov dword [ebp - 0x10e8c], esi
mov dword [ebp - 0x10e90], esi
mov dword [ebp - 0x10e88], esi
mov dword [ebp - 0x10eb4], esi
mov dword [ebp - 0x10ee0], esi
mov dword [ebp - 0x10edc], esi
mov dword [ebp - 0x10e80], esi
mov dword [ebp - 0x10ebc], esi
mov dword [ebp - 0x10e94], esi
mov dword [ebp - 0x10ecc], esi
mov dword [ebp - 0x10e9c], esi
mov ecx, dword [ebp - 0x10e78]
mov eax, dword [ecx + 0x18]
cmp eax, 1
jne 0x47ff9e
mov edi, 0xb1
mov dword [ebp - 0x10e74], esi
cmp esi, edi
jge 0x47ffbc
mov eax, dword [esi*4 + 0x684780]
cmp byte [eax], 0
je 0x47ffbc
push str..lsp
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fc6e
mov ebx, 1
mov dword [ebp - 0x10ee4], ebx
jmp 0x47ff80
push str..taz
mov edx, dword [esi*4 + 0x684780]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fc96
mov dword [ebp - 0x10e98], 1
jmp 0x47ff80
push str..ism
mov eax, dword [esi*4 + 0x684780]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fcbe
mov dword [ebp - 0x10ea0], 1
jmp 0x47ff80
push 0x611a10
mov ecx, dword [esi*4 + 0x684780]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fce6
mov dword [ebp - 0x10ea8], 1
jmp 0x47ff80
push str..fas
mov edx, dword [esi*4 + 0x684780]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fd0e
mov dword [ebp - 0x10eb0], 1
jmp 0x47ff80
push 0x6119bc
mov eax, dword [esi*4 + 0x684780]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fd36
mov dword [ebp - 0x10eb8], 1
jmp 0x47ff80
push 0x6119b4
mov ecx, dword [esi*4 + 0x684780]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fd5e
mov dword [ebp - 0x10ec0], 1
jmp 0x47ff80
push str..mai
mov edx, dword [esi*4 + 0x684780]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fd86
mov dword [ebp - 0x10ec8], 1
jmp 0x47ff80
push str..db
mov eax, dword [esi*4 + 0x684780]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fdae
mov dword [ebp - 0x10ed0], 1
jmp 0x47ff80
push str..file
mov ecx, dword [esi*4 + 0x684780]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fdd6
mov dword [ebp - 0x10ed8], 1
jmp 0x47ff80
push str..dex
mov edx, dword [esi*4 + 0x684780]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fdfe
mov dword [ebp - 0x10ee0], 1
jmp 0x47ff80
push str..apk
mov eax, dword [esi*4 + 0x684780]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fe26
mov dword [ebp - 0x10eb4], 1
jmp 0x47ff80
push str..msg
mov ecx, dword [esi*4 + 0x684780]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fe4e
mov dword [ebp - 0x10e88], 1
jmp 0x47ff80
push 0x6340d8
mov edx, dword [esi*4 + 0x684780]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fe76
mov dword [ebp - 0x10e90], 1
jmp 0x47ff80
push str..elf
mov eax, dword [esi*4 + 0x684780]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fe9e
mov dword [ebp - 0x10e8c], 1
jmp 0x47ff80
push 0x61195c
mov ecx, dword [esi*4 + 0x684780]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47fec6
mov dword [ebp - 0x10ecc], 1
jmp 0x47ff80
push str..url
mov edx, dword [esi*4 + 0x684780]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47feee
mov dword [ebp - 0x10e94], 1
jmp 0x47ff80
push str..ps1
mov eax, dword [esi*4 + 0x684780]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47ff13
mov dword [ebp - 0x10ebc], 1
jmp 0x47ff80
push str..img
mov ecx, dword [esi*4 + 0x684780]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47ff38
mov dword [ebp - 0x10e9c], 1
jmp 0x47ff80
push str..iso
mov edx, dword [esi*4 + 0x684780]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47ff5d
mov dword [ebp - 0x10edc], 1
jmp 0x47ff80
push str..iqy
mov eax, dword [esi*4 + 0x684780]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47ff80
mov dword [ebp - 0x10e80], 1
push 0
push 0x2c
mov ecx, dword [esi*4 + 0x684780]
push ecx
lea edx, [ebp - 0x10e6c]
push edx
call fcn.004e5820
inc esi
jmp 0x47fc2e
cmp eax, 2
jne 0x480285
push 0
push 0x2c
push 0x66da74
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
test ebx, ebx
jne 0x47ffd4
push ebx
push 0x2c
push str..lsp
lea ecx, [ebp - 0x10e6c]
push ecx
call fcn.004e5820
cmp dword [ebp - 0x10e98], 0
jne 0x47fff2
push 0
push 0x2c
push str..taz
lea edx, [ebp - 0x10e6c]
push edx
call fcn.004e5820
cmp dword [ebp - 0x10ea0], 0
jne 0x480010
push 0
push 0x2c
push str..ism
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
cmp dword [ebp - 0x10ea8], 0
jne 0x48002e
push 0
push 0x2c
push 0x611a10
lea ecx, [ebp - 0x10e6c]
push ecx
call fcn.004e5820
cmp dword [ebp - 0x10eb0], 0
jne 0x48004c
push 0
push 0x2c
push str..fas
lea edx, [ebp - 0x10e6c]
push edx
call fcn.004e5820
cmp dword [ebp - 0x10eb8], 0
jne 0x48006a
push 0
push 0x2c
push 0x6119bc
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
cmp dword [ebp - 0x10ec0], 0
jne 0x480088
push 0
push 0x2c
push 0x6119b4
lea ecx, [ebp - 0x10e6c]
push ecx
call fcn.004e5820
cmp dword [ebp - 0x10ec8], 0
jne 0x4800a6
push 0
push 0x2c
push str..mai
lea edx, [ebp - 0x10e6c]
push edx
call fcn.004e5820
cmp dword [ebp - 0x10ed0], 0
jne 0x4800c4
push 0
push 0x2c
push str..db
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
cmp dword [ebp - 0x10ed8], 0
jne 0x4800e2
push 0
push 0x2c
push str..file
lea ecx, [ebp - 0x10e6c]
push ecx
call fcn.004e5820
cmp dword [ebp - 0x10ee0], 0
jne 0x480100
push 0
push 0x2c
push str..dex
lea edx, [ebp - 0x10e6c]
push edx
call fcn.004e5820
cmp dword [ebp - 0x10eb4], 0
jne 0x48011e
push 0
push 0x2c
push str..apk
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
cmp dword [ebp - 0x10e88], 0
jne 0x48013c
push 0
push 0x2c
push str..msg
lea ecx, [ebp - 0x10e6c]
push ecx
call fcn.004e5820
cmp dword [ebp - 0x10e90], 0
jne 0x48015a
push 0
push 0x2c
push 0x6340d8
lea edx, [ebp - 0x10e6c]
push edx
call fcn.004e5820
cmp dword [ebp - 0x10e8c], 0
jne 0x480178
push 0
push 0x2c
push str..elf
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
cmp dword [ebp - 0x10ecc], 0
jne 0x480196
push 0
push 0x2c
push 0x61195c
lea ecx, [ebp - 0x10e6c]
push ecx
call fcn.004e5820
cmp dword [ebp - 0x10e94], 0
jne 0x4801b4
push 0
push 0x2c
push str..url
lea edx, [ebp - 0x10e6c]
push edx
call fcn.004e5820
cmp dword [ebp - 0x10ebc], 0
jne 0x4801d2
push 0
push 0x2c
push str..ps1
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
cmp dword [ebp - 0x10e9c], 0
jne 0x4801f0
push 0
push 0x2c
push str..img
lea ecx, [ebp - 0x10e6c]
push ecx
call fcn.004e5820
cmp dword [ebp - 0x10edc], 0
jne 0x48020e
push 0
push 0x2c
push str..iso
lea edx, [ebp - 0x10e6c]
push edx
call fcn.004e5820
xor ebx, ebx
cmp dword [ebp - 0x10e80], ebx
jne 0x48022c
push ebx
push 0x2c
push str..iqy
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
push 0x2c
push str..dwg
mov ecx, dword [ebp - 0x10e6c]
push ecx
call fcn.004e5560
mov edx, dword [ebp - 0x10e6c]
push edx
push ebx
push 1
call fcn.00469e50
add esp, 0xc
mov ecx, dword [ebp - 0x10e6c]
cmp ecx, ebx
je 0x480749
cmp dword [0x71de6c], ebx
je 0x480701
push ecx
cmp eax, ebx
jne 0x4806c2
push str.Include_Lists:__s
lea eax, [ebp - 0x10e68]
push eax
jmp 0x4806ce
cmp eax, 3
jne 0x47ffbc
xor edi, edi
mov dword [ebp - 0x10e74], edi
lea ecx, [edi + edi*4]
mov edx, dword [ebp - 0x10e78]
lea esi, [edx + ecx*4 + 0x1c]
cmp byte [esi], 0
je 0x47ffbc
push str..lsp
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4802dc
mov ebx, 1
mov dword [ebp - 0x10ee4], ebx
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..taz
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48030b
mov dword [ebp - 0x10e98], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..ism
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48033d
mov dword [ebp - 0x10ea0], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push 0x611a10
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48036f
mov dword [ebp - 0x10ea8], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..fas
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4803a1
mov dword [ebp - 0x10eb0], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push 0x6119bc
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4803d3
mov dword [ebp - 0x10eb8], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push 0x6119b4
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x480405
mov dword [ebp - 0x10ec0], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..mai
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x480437
mov dword [ebp - 0x10ec8], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..db
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x480469
mov dword [ebp - 0x10ed0], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..file
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48049b
mov dword [ebp - 0x10ed8], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..dex
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4804cd
mov dword [ebp - 0x10ee0], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..apk
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4804ff
mov dword [ebp - 0x10eb4], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..msg
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x480531
mov dword [ebp - 0x10e88], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push 0x6340d8
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x480563
mov dword [ebp - 0x10e90], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..elf
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x480595
mov dword [ebp - 0x10e8c], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push 0x61195c
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4805c7
mov dword [ebp - 0x10ecc], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..url
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4805f9
mov dword [ebp - 0x10e94], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..ps1
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48062b
mov dword [ebp - 0x10ebc], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..img
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48065d
mov dword [ebp - 0x10e9c], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..iso
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48068f
mov dword [ebp - 0x10edc], 1
push eax
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str..iqy
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4806ab
mov dword [ebp - 0x10e80], 1
push 0
push 0x2c
push esi
lea eax, [ebp - 0x10e6c]
push eax
call fcn.004e5820
inc edi
jmp 0x480290
push str.Include_Lists:__s__ALL_FILES_MODE_
lea ecx, [ebp - 0x10e68]
push ecx
call fcn.005dfb23
add esp, 0xc
push ebx
push 1
lea edx, [ebp - 0x10e68]
push edx
push 0x6aec98
call fcn.004311c0
push ebx
push 1
push 0x60ef34
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x48071a
cmp eax, ebx
je 0x480720
push ebx
push 1
push str.ALL_FILES_MODE
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov ecx, dword [ebp - 0x10e6c]
push ebx
push ecx
mov eax, dword [0x71de6c]
push eax
mov ecx, dword [0x6e914c]
push ecx
call fcn.00457940
mov edx, dword [ebp - 0x10e6c]
push edx
call fcn.005e0865
add esp, 0x14
mov dword [ebp - 0x10e6c], ebx
mov dword [ebp - 0x10e70], ebx
mov eax, dword [ebp - 0x10e78]
cmp dword [eax + 0x1f5c], ebx
je 0x480be4
xor edi, edi
mov dword [ebp - 0x10e74], edi
lea ecx, [edi + edi*4]
mov eax, dword [ebp - 0x10e78]
lea esi, [eax + ecx*4 + 0xfbc]
cmp byte [esi], 0
je 0x4807e0
push esi
call fcn.004dc390
add esp, 4
cmp eax, 1
jne 0x48079d
push ebx
push 0x2c
push esi
push 0x6e9880
call fcn.004e5820
inc edi
jmp 0x480763
push esi
call fcn.00452f50
add esp, 4
push ebx
cmp eax, 1
jne 0x4807be
push 0x2c
push esi
lea edx, [ebp - 0x10e70]
push edx
call fcn.004e5820
inc edi
jmp 0x480763
push esi
push ebx
call fcn.00469e50
add esp, 0xc
cmp eax, 1
jne 0x4807dd
push ebx
push 0x2c
push esi
lea eax, [ebp - 0x10e70]
push eax
call fcn.004e5820
inc edi
jmp 0x480763
push ebx
push 0x2c
cmp dword [eax + 0x33f68], 7
jge 0x480b0f
push str..nlb
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..ora
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..msb
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..pm
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..ctl
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..ix
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..manifest
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..policy
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..log
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push 0x611784
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..pf
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..ecn
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..ldb
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..trc
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push 0x611a3c
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..cdr
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..klr
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..avs
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..3ds
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..ac_
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..aws
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dwf
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dwg
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..bak
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dwl
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dwl2
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..vsv
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..vhd
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..vhdx
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..avhd
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..avhdx
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..vbox
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dws
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dwt
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..sv_
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dxf
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..ms_
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..msq
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push 0x633fd8
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str.jar_cache.tmp
lea ecx, [ebp - 0x10e70]
push ecx
call fcn.004e5820
push ebx
push 0x2c
push str.acgenral.dll
lea edx, [ebp - 0x10e70]
push edx
call fcn.004e5820
push ebx
push 0x2c
push str.updll.dll
lea eax, [ebp - 0x10e70]
push eax
call fcn.004e5820
push ebx
push 0x2c
push str.updll.dll3
lea ecx, [ebp - 0x10e70]
push ecx
call fcn.004e5820
push ebx
push 0x2c
push str.updll.dlz
lea edx, [ebp - 0x10e70]
push edx
jmp 0x480bdf
push str..bak
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dwl
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dwl2
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..vsv
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..vhd
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..vhdx
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..avhd
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..avhdx
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..vbox
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dws
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..dwt
push 0x6e9880
call fcn.004e5820
push ebx
push 0x2c
push str..sv_
push 0x6e9880
call fcn.004e5820
push 0x2c
push 0x633fc4
mov eax, dword [0x6e9880]
push eax
call fcn.004e5560
push 0x2c
push str..db
mov ecx, dword [0x6e9880]
push ecx
call fcn.004e5560
push 0x2c
push 0x633fbc
mov edx, dword [0x6e9880]
push edx
call fcn.004e5560
push 0x2c
push str..class
mov eax, dword [0x6e9880]
push eax
call fcn.004e5560
push 0x2c
push str..mdb
mov ecx, dword [0x6e9880]
push ecx
call fcn.004e5560
push 0x2c
push 0x611a3c
mov edx, dword [0x6e9880]
push edx
call fcn.004e5560
push 0x2c
push str..pmm
mov eax, dword [0x6e9880]
push eax
call fcn.004e5560
push 0x2c
push 0x61195c
mov ecx, dword [0x6e9880]
push ecx
call fcn.004e5560
push 0x2c
push str.ac.tmp
mov edx, dword [ebp - 0x10e70]
push edx
call fcn.004e5560
push 0x2c
push str.spnsrv.
mov eax, dword [ebp - 0x10e70]
push eax
call fcn.004e5560
push 0x2c
push str.._DF
mov ecx, dword [ebp - 0x10e70]
push ecx
call fcn.004e5560
push ebx
push 0x2c
push str.ack.tmp
lea edx, [ebp - 0x10e70]
push edx
call fcn.004e5820
push ebx
push 0x2c
push str.metabase.xml
lea eax, [ebp - 0x10e70]
push eax
call fcn.004e5820
mov ecx, dword [ebp - 0x10e70]
push ecx
push ebx
push 1
call fcn.00469ff0
add esp, 0xc
mov eax, dword [ebp - 0x10e70]
cmp eax, ebx
je 0x480d4e
cmp dword [0x71de6c], ebx
je 0x480d3f
push eax
push str.Strong_Exclude_List:__s
lea edx, [ebp - 0x10e68]
push edx
call fcn.005dfb23
push ebx
push 1
lea eax, [ebp - 0x10e68]
push eax
push 0x6aec98
call fcn.004311c0
push ebx
push 1
push 0x60ef34
push 0x6aec98
call fcn.004311c0
add esp, 0x2c
mov eax, dword [ebp - 0x10e70]
push eax
call fcn.005e0865
add esp, 4
mov dword [ebp - 0x10e70], ebx
mov eax, dword [0x6e9880]
cmp eax, ebx
je 0x480de2
cmp dword [0x6e91c4], ebx
jne 0x480dbe
cmp dword [0x71de6c], ebx
je 0x480de2
push eax
mov ecx, dword [ebp - 0x10e78]
mov edx, dword [ecx + 0x33f68]
push edx
push str.Driver_Exclude_Extensions_List__d_:__s
lea eax, [ebp - 0x10e68]
push eax
call fcn.005dfb23
push ebx
mov ecx, dword [0x71de6c]
push ecx
lea edx, [ebp - 0x10e68]
push edx
push 0x6aec98
call fcn.004311c0
push ebx
mov eax, dword [0x71de6c]
push eax
push 0x60ef34
push 0x6aec98
call fcn.004311c0
add esp, 0x30
jmp 0x480de2
push ebx
push 1
cmp dword [0x685bcc], ebx
je 0x480dd0
push str.Pre_Extensions_excluded_in_driver_2a___LOG_FILE_TXFERS_TO_USB_.
jmp 0x480dd5
push str.No_Extensions_excluded_in_driver_2a___LOG_FILE_TXFERS_TO_USB_.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x6e9870
call fcn.004a5a80
add esp, 4
mov eax, dword [0x6e9264]
cmp eax, ebx
je 0x480e07
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e9264], ebx
xor esi, esi
mov edi, dword [ebp - 0x10e78]
mov ecx, dword [edi + 0x1af60]
mov dword [0x685b8c], ecx
mov dword [ebp - 0x10e74], esi
mov edx, esi
shl edx, 9
lea eax, [edx + edi + 0x1f60]
cmp byte [eax], 0
je 0x480e43
push ebx
push 0x2c
push eax
push 0x6e9264
call fcn.004e5820
inc esi
jmp 0x480e1b
mov eax, dword [0x6e9874]
cmp eax, ebx
je 0x480e5b
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e9874], ebx
mov eax, dword [0x6e9878]
cmp eax, ebx
je 0x480e73
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e9878], ebx
mov eax, dword [edi + 0x33f64]
mov dword [0x6e915c], eax
cmp dword [0x67e110], ebx
je 0x480f7e
push 1
push 1
push 0x6e9878
push 0x6e9874
call fcn.004cdce0
add esp, 0x10
or ebx, 0xffffffff
xor edi, edi
mov dword [ebp - 0x10ef4], edi
lea edx, [ebp - 0x10ef4]
push edx
push str.NWSwiftScan
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp al, 1
jne 0x48103a
mov dword [ebp - 0x10ed4], edi
lea eax, [ebp - 0x10ed4]
push eax
call fcn.00455730
add esp, 4
mov esi, dword [ebp - 0x10ed4]
cmp esi, edi
je 0x48103a
cmp byte [esi], 0
je 0x48102b
mov byte [ebp - 0x1068], 0
push 0x40f
push edi
lea ecx, [ebp - 0x1067]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x10eac], edi
push 1
push edi
push 0x2c
lea edx, [ebp - 0x10eac]
push edx
lea eax, [ebp - 0x1068]
push eax
push esi
call fcn.004e1380
add esp, 0x24
jmp 0x480f40
cmp dword [ebp - 0x10eac], ebx
je 0x48102b
push edi
push 0x2c
lea ecx, [ebp - 0x1068]
push ecx
push 0x6e9878
call fcn.004e5820
push 1
push edi
push 0x2c
lea edx, [ebp - 0x10eac]
push edx
lea eax, [ebp - 0x1068]
push eax
push esi
call fcn.004e1380
add esp, 0x18
jmp 0x480f40
mov byte [ebp - 0x1468], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x1467]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x10ec4], 0
push 1
lea edx, [ebp - 0x1468]
push edx
call fcn.004e9c00
push 1
push 0
push 0x2c
lea eax, [ebp - 0x10ec4]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x1468]
push edx
call fcn.004e1380
add esp, 0x2c
or ebx, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea esp, [esp]
cmp dword [ebp - 0x10ec4], ebx
je 0x480ea3
push 0x66da34
lea eax, [ebp - 0x28]
push eax
call esi
push 1
push 0x2c
lea ecx, [ebp - 0x28]
push ecx
push 0x6e9874
call fcn.004e5820
push 1
push 0
push 0x2c
lea edx, [ebp - 0x10ec4]
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1468]
push ecx
call fcn.004e1380
add esp, 0x18
jmp 0x480fe0
push esi
call fcn.005e0865
add esp, 4
mov dword [ebp - 0x10ed4], edi
push edi
push 1
call fcn.004ce2a0
lea ecx, [ebp - 0x10e7c]
push ecx
call fcn.00456950
mov edx, dword [ebp - 0x10e7c]
push edx
push edi
push 1
call fcn.00469a90
add esp, 0x18
mov eax, dword [0x6e987c]
cmp eax, edi
je 0x481078
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e987c], edi
mov byte [ebp - 0x848], 0
push 0x207
push edi
lea eax, [ebp - 0x847]
push eax
call fcn.005dfd60
mov byte [ebp - 0xa50], 0
push 0x207
push edi
lea ecx, [ebp - 0xa4f]
push ecx
call fcn.005dfd60
mov byte [ebp - 0xc58], 0
push 0x207
push edi
lea edx, [ebp - 0xc57]
push edx
call fcn.005dfd60
add esp, 0x24
mov dword [ebp - 0x10e84], edi
mov ecx, 0x6b08d8
lea edx, [ebp - 0xa50]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4810d7
push 0x208
lea eax, [ebp - 0xc58]
push eax
call fcn.004ebf90
add esp, 8
cmp byte [ebp - 0xa50], 0
je 0x4812a5
cmp byte [ebp - 0xc58], 0
je 0x4812a5
push 1
push edi
push 0x2c
lea ecx, [ebp - 0x10e84]
push ecx
lea edx, [ebp - 0x848]
push edx
mov eax, dword [str.services.exe__winlogon.exe__lsass.exe__rpcss.exe___t_t_t_t_t_t_t_t_t_tspoolss.exe__svchost.exe__spoolsv.exe__userinit.exe___t_t_t_t_t_t_t_t_t_texplorer.exe__ws2_32.dll__mswsock.dll__comres.dll___t_t_t_t_t_t_t_t_t_tntfs.sys]
push eax
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x10e84], ebx
je 0x4812a5
mov byte [ebp - 0x334], 0
push 0x207
push edi
lea ecx, [ebp - 0x333]
push ecx
call fcn.005dfd60
push 0x618e20
lea edx, [ebp - 0x848]
push edx
call fcn.005e324f
add esp, 0x14
test eax, eax
jne 0x4811bf
lea ecx, [ebp - 0xc58]
lea edx, [ebp - 0x334]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x481180
lea eax, [ebp - 0x334]
push eax
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x848]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4811a1
sub eax, edx
lea edi, [ebp - 0x334]
add edi, ebx
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4811b2
jmp 0x48127a
push str.ntfs.sys
lea ecx, [ebp - 0x848]
push ecx
call fcn.005e324f
add esp, 8
lea ecx, [ebp - 0xa50]
lea edx, [ebp - 0x334]
test eax, eax
jne 0x481240
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4811e3
lea edx, [ebp - 0x334]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x334]
add eax, ebx
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x481204
mov ecx, dword [str.drivers_ntfs.sys]
mov dword [eax], ecx
mov edx, dword [0x6342b4]
mov dword [eax + 4], edx
mov ecx, dword [0x6342b8]
mov dword [eax + 8], ecx
mov edx, dword [0x6342bc]
mov dword [eax + 0xc], edx
mov cl, byte [0x6342c0]
mov byte [eax + 0x10], cl
jmp 0x48128a
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x481240
lea edx, [ebp - 0x334]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x848]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x481261
sub eax, edx
lea edi, [ebp - 0x334]
add edi, ebx
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x481272
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push 0x2c
lea eax, [ebp - 0x334]
push eax
push 0x6e987c
call fcn.004e5820
jmp 0x48110f
cmp dword [0x71de6c], edi
je 0x481530
mov ecx, dword [ebp - 0x10e78]
mov edx, dword [ecx + 0x33f68]
push edx
push str.Config_File_Version__avpmCfg.klr__:__d
lea eax, [ebp - 0x10e68]
push eax
call fcn.005dfb23
push edi
push 1
lea ecx, [ebp - 0x10e68]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [0x6e9874]
cmp eax, edi
je 0x481318
push eax
push str.Exclude_Folder_List:__s
lea edx, [ebp - 0x10e68]
push edx
call fcn.005dfb23
push edi
push 1
lea eax, [ebp - 0x10e68]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [0x6e9878]
cmp eax, edi
je 0x48134a
push eax
push str.Exclude_Drives_List:__s
lea ecx, [ebp - 0x10e68]
push ecx
call fcn.005dfb23
push edi
push 1
lea edx, [ebp - 0x10e68]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [0x6e9264]
cmp eax, edi
je 0x48137c
push eax
push str.Not_A_Virus_GUI_List:__s
lea eax, [ebp - 0x10e68]
push eax
call fcn.005dfb23
push edi
push 1
lea ecx, [ebp - 0x10e68]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [0x6e9870]
cmp eax, edi
je 0x4813ae
push eax
push str.Not_A_Virus_AVS_List:__s
lea edx, [ebp - 0x10e68]
push edx
call fcn.005dfb23
push edi
push 1
lea eax, [ebp - 0x10e68]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [ebp - 0x10e7c]
cmp eax, edi
je 0x4813e1
push eax
push str.Exclude_Proc_List:__s
lea ecx, [ebp - 0x10e68]
push ecx
call fcn.005dfb23
push edi
push 1
lea edx, [ebp - 0x10e68]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [0x6e987c]
cmp eax, edi
je 0x481413
push eax
push str.Critical_Processes_List:__s
lea eax, [ebp - 0x10e68]
push eax
call fcn.005dfb23
push edi
push 1
lea ecx, [ebp - 0x10e68]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov edx, dword [0x6e8c6c]
cmp edx, edi
je 0x481501
mov eax, dword [str.Scanning_Modes:]
mov dword [ebp - 0x10e68], eax
mov ecx, dword [0x63421c]
mov dword [ebp - 0x10e64], ecx
mov eax, dword [0x634220]
mov dword [ebp - 0x10e60], eax
mov ecx, dword [0x634224]
mov dword [ebp - 0x10e5c], ecx
mov al, byte [0x634228]
mov byte [ebp - 0x10e58], al
test edx, 0x10000
je 0x4814a4
lea eax, [ebp - 0x10e68]
add eax, ebx
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x481470
mov ecx, dword [str.MSV_O_M_PACKED_]
mov dword [eax], ecx
mov ecx, dword [0x634208]
mov dword [eax + 4], ecx
mov ecx, dword [0x63420c]
mov dword [eax + 8], ecx
mov ecx, dword [0x634210]
mov dword [eax + 0xc], ecx
mov cl, byte [0x634214]
mov byte [eax + 0x10], cl
test edx, 0x20400
je 0x4814e8
lea eax, [ebp - 0x10e68]
add eax, ebx
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4814b4
mov edx, dword [str.MSV_O_M_ARCHIVED]
mov dword [eax], edx
mov ecx, dword [0x6341f4]
mov dword [eax + 4], ecx
mov edx, dword [0x6341f8]
mov dword [eax + 8], edx
mov ecx, dword [0x6341fc]
mov dword [eax + 0xc], ecx
mov dl, byte [0x634200]
mov byte [eax + 0x10], dl
xor edi, edi
push edi
push 1
lea eax, [ebp - 0x10e68]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov ecx, dword [0x6e914c]
push ecx
push str.Cleaning_Modes:__d
lea edx, [ebp - 0x10e68]
push edx
call fcn.005dfb23
push edi
push 1
lea eax, [ebp - 0x10e68]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0x10eec], 1
xor edi, edi
jmp 0x481573
cmp dword [0x71de6c], edi
je 0x481573
push str.ReadBdSettingsStructures_Failed_
lea ecx, [ebp - 0x10e68]
push ecx
call fcn.005dfb23
push edi
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x10e68]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x18
push edi
push 1
push str.Config_File_Read._Settings_File_Mutex_Getting_Released
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6e9250], edi
je 0x4815d4
push 0x6e9250
call fcn.004da880
add esp, 4
jmp 0x4815d4
cmp dword [0x71de6c], edi
je 0x4815d4
push str.Unable_to_lock_mutex_
lea ecx, [ebp - 0x10e68]
push ecx
call fcn.005dfb23
push edi
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x10e68]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov eax, dword [ebp - 0x10e7c]
cmp eax, edi
je 0x48160e
push eax
call fcn.005e0865
add esp, 4
mov dword [ebp - 0x10e7c], edi
jmp 0x48160e
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x10eec]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret