Function at 0x4017e0
Capabilities:
Enumerate services

Disassembly:
push ebp
push edi
mov eax, 0x904c
push esi
push ebx
call fcn.00403020
sub esp, eax
mov dword [esp + 8], 5
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebp, eax
sub esp, 0xc
mov eax, str.Erro_ao_abrir_o_Gerenciador_de_Controle_de_Servios
test ebp, ebp
je 0x401a8d
lea eax, [esp + 0x38]
lea esi, [esp + 0x40]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0x9000
mov dword [esp + 8], 1
mov dword [esp + 0x18], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0x30
mov dword [esp], ebp
mov dword [esp + 0x14], eax
call sub.ADVAPI32.DLL_EnumServicesStatusA
sub esp, 0x20
mov eax, dword [esp + 0x38]
test eax, eax
mov dword [esp + 0x2c], eax
je 0x401a7d
xor edi, edi
mov ebx, dword [esi]
mov dword [esp + 4], str.McAfee
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401aa0
mov dword [esp + 4], str.McShield
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401aa0
mov dword [esp + 4], str.avast
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401ac0
mov dword [esp + 4], str.Norton
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401ab0
mov dword [esp + 4], 0x40c582
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401ab0
mov dword [esp + 4], 0x40c586
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401ad0
mov dword [esp + 4], str.BitDefender
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401ae0
mov dword [esp + 4], str.Kaspersky
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401af0
mov dword [esp + 4], str.ESET
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b00
mov dword [esp + 4], str.Sophos
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b10
mov dword [esp + 4], str.Malwarebytes
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b20
mov dword [esp + 4], str.Panda
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b30
mov dword [esp + 4], str.Avira
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b40
mov dword [esp + 4], str.Trend_Micro
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b50
mov dword [esp + 4], str.Comodo
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b60
mov dword [esp + 4], str.TotalAV
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b70
mov dword [esp + 4], str.Avira_Phantom
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b80
mov dword [esp + 4], str.F_Secure
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401b90
mov dword [esp + 4], str.Bitdefender_Total_Security
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401ba0
mov dword [esp + 4], str.Kaspersky_Total_Security
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401bb0
mov dword [esp + 4], str.Norton_360
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401bc0
add edi, 1
add esi, 0x24
cmp edi, dword [esp + 0x2c]
jne 0x401873
mov dword [esp], ebp
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, str.Nenhum_antivirus_conhecido_esta_instalado.
sub esp, 4
add esp, 0x904c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, str.McAfee_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Norton_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Avast_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.AVG_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.BitDefender_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Kaspersky_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.ESET_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Sophos_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Malwarebytes_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Panda_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Avira_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Trend_Micro_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Comodo_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.TotalAV_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Avira_Phantom_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.F_Secure_Antivirus_est_instalado
jmp 0x401a8d
mov eax, str.Bitdefender_Total_Security_est_instalado
jmp 0x401a8d
mov eax, str.Kaspersky_Total_Security_est_instalado
jmp 0x401a8d
mov eax, str.Norton_360_est_instalado.
jmp 0x401a8d