Function at 0x4536b0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4e9dfd
mov eax, dword fs:[0]
push eax
mov eax, 0x2f34
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x2f30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x2f48]
mov dword fs:[0], eax
mov dword [esp + 0x30], ecx
mov ebx, dword [esp + 0x2f58]
mov edi, dword [esp + 0x2f5c]
mov esi, dword [esp + 0x2f64]
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov eax, dword [0x103a97c]
mov dword [esp + 0x34], ebx
cmp eax, 4
je 0x453723
cmp eax, 0x99
jne 0x453732
push str._t_t_tCanHookDeep_start
push 8
call fcn.0043d500
add esp, 8
test dword [0x1039f54], 0xc00
mov dword [esp + 0x2c], 4
je 0x45374e
mov dword [esp + 0x2c], 1
cmp ebx, ebp
je 0x4537df
push 0x400
lea eax, [esp + 0x844]
push ebp
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp byte [esi], 0
jne 0x4537e7
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebp
je 0x45379d
push 0x400
lea ecx, [esp + 0x844]
push ecx
push eax
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jne 0x45379d
mov byte [esp + 0x840], al
jmp 0x4537a7
cmp byte [esp + 0x840], 0
jne 0x45381a
push 0x7fc
lea edx, [esp + 0x274c]
push ebp
push edx
mov dword [esp + 0x2750], ebp
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x2750]
add esp, 0xc
push 0x400
lea eax, [esp + 0x844]
push eax
push ecx
push ebx
call sub.PSAPI.DLL_GetModuleBaseNameA
or eax, 0xffffffff
jmp 0x454feb
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4537f0
sub eax, edx
cmp eax, 0x400
jae 0x45381a
lea edx, [esp + 0x840]
mov eax, esi
sub edx, esi
jmp 0x453810
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x453810
lea edx, [esp + 0x840]
push edx
call dword [sym.imp.MSVCR90.dll__strlwr]
push ebp
lea eax, [esp + 0x848]
push 1
push eax
call fcn.0046aae0
add esp, 0x10
test eax, eax
jne 0x45384f
lea ecx, [esp + 0x840]
push ecx
call fcn.00453580
add esp, 4
lea edx, [esp + 0x840]
push edx
call fcn.004518c0
lea eax, [esp + 0x844]
add esp, 4
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x453870
sub eax, edx
cmp eax, 0x400
jae 0x4537df
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x2f50], 0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x2f60]
push eax
push esi
push edi
lea ecx, [esp + 0x84c]
push ebp
push ecx
call fcn.00452490
mov esi, eax
add esp, 0x14
cmp esi, 0xfffffffd
jne 0x453b88
xor bl, bl
cmp byte [0x101f3f0], bl
je 0x4538e6
push 0x101f3f0
lea edx, [esp + 0x844]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4538e6
mov bl, 1
test dword [0x1039f54], 0x20000
jne 0x45393b
lea eax, [esp + 0x840]
push str.system32winlogon.exe
push eax
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
mov esi, 0x600
test eax, eax
je 0x453919
cmp dword [0x53f200], esi
jge 0x453980
lea ecx, [esp + 0x840]
push str.system32wininit.exe
push ecx
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
test eax, eax
je 0x45393b
cmp dword [0x53f200], esi
jge 0x453980
mov esi, dword [sym.imp.MSVCR90.dll_strstr]
lea edx, [esp + 0x840]
push 0x50e04c
push edx
call esi
add esp, 8
test eax, eax
je 0x45399f
lea eax, [esp + 0x840]
push str._x86.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x45399f
test bl, bl
je 0x453980
push 0x50e020
push 8
call fcn.0043d500
add esp, 8
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 0xfffffffe
jmp 0x454feb
push 0x200
lea ecx, [esp + 0x1548]
push 0
push ecx
call sub.MSVCR90.dll_memset
push 0x1ff
lea edx, [esp + 0x1f55]
push 0
push edx
mov byte [esp + 0x1f5c], 0
call sub.MSVCR90.dll_memset
push 0x1ff
lea eax, [esp + 0xf61]
push 0
push eax
mov byte [esp + 0xf68], 0
call sub.MSVCR90.dll_memset
push 0x5116d8
push 0x50e01c
lea ecx, [esp + 0xf70]
push ecx
lea edx, [esp + 0x870]
push edx
call fcn.0044e9b0
push 0x5116d8
push 0x50e014
lea eax, [esp + 0x1f80]
push eax
lea ecx, [esp + 0xf84]
push ecx
call fcn.0044e9b0
add esp, 0x44
push 0x5116d8
push 0x502f14
lea edx, [esp + 0xf4c]
push edx
lea eax, [esp + 0x1f50]
push eax
call fcn.0044e9b0
mov eax, dword [0x103a97c]
add esp, 0x10
cmp eax, 4
je 0x453a5f
cmp eax, 0x99
jne 0x453a6e
push str._t_t_tCanHookDeep_TC_CARE_MS_LOW
push 8
call fcn.0043d500
add esp, 8
push 0x2f9
push str.panda_SECURITY
lea ecx, [esp + 0x154c]
push ecx
lea edx, [esp + 0xf50]
push edx
call fcn.00450dd0
add esp, 0x10
test al, al
je 0x453ad1
test bl, bl
jne 0x453aad
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x453aad
cmp eax, 0x99
jne 0x453980
lea eax, [esp + 0x1544]
push eax
lea ecx, [esp + 0xf48]
push ecx
push str.GetSignOfExePass_Except_Process__s_szSign__s_
push 8
call fcn.0043d500
add esp, 0x10
jmp 0x453980
test bl, bl
jne 0x453ae6
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x453ae6
cmp eax, 0x99
jne 0x453b0a
lea edx, [esp + 0x1544]
push edx
lea eax, [esp + 0xf48]
push eax
push 0x50dc90
push 8
call fcn.0043d500
mov eax, dword [0x103a97c]
add esp, 0x10
test dword [0x10430cc], 0x40000000
je 0x453b48
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x742de4]
jae 0x453b43
mov eax, ebp
xor esi, esi
test eax, eax
je 0x453b43
cmp eax, dword [0x742de8]
je 0x453b65
push eax
call fcn.00450350
inc esi
add esp, 4
cmp esi, 4
jl 0x453b28
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x453b54
cmp eax, 0x99
jne 0x453b96
push str._t_t_tCanHookDeep
push 8
call fcn.0043d500
add esp, 8
jmp 0x453b91
test bl, bl
jne 0x453b7e
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x453b7e
cmp eax, 0x99
jne 0x453980
push 0x50dbf0
jmp 0x453976
cmp esi, 0xfffffffc
jne 0x454fd4
mov eax, dword [0x103a97c]
test dword [0x103a364], 0x100000
je 0x453c00
cmp dword [0x103a994], 0
je 0x453c00
cmp byte [edi + 0x43c], 0
jne 0x453c00
cmp eax, 0x98
je 0x453bc7
cmp eax, 0x99
je 0x453bc7
cmp eax, 0x67
jne 0x453bdf
lea ecx, [esp + 0xf44]
push ecx
push ebp
push str.PostMessage_WM_CHK_CERT__d___s_
push 8
call fcn.0043d500
add esp, 0x10
mov edx, dword [0x103a994]
push ebp
push 2
push 0x179f
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [edi + 0x43c], 1
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x453c0c
cmp eax, 0x99
jne 0x453c20
push 0x50db90
push 8
call fcn.0043d500
mov eax, dword [0x103a97c]
add esp, 8
test dword [0x1038f3c], 0x1000
je 0x454082
cmp eax, 4
je 0x453c3c
cmp eax, 0x99
jne 0x453c4b
push str._t_t_tCanHookDeep_
push 8
call fcn.0043d500
add esp, 8
lea eax, [esp + 0x840]
push eax
mov byte [esp + 0x1b], 1
xor ebx, ebx
call fcn.0044f7c0
push 0x200
lea ecx, [esp + 0xd4c]
push ebx
push ecx
mov byte [esp + 0x2f], al
call sub.MSVCR90.dll_memset
lea edx, [esp + 0xd54]
push edx
lea eax, [esp + 0xf58]
push eax
call fcn.0043cef0
add esp, 0x18
cmp byte [esp + 0x1f], bl
jne 0x453cc7
lea ecx, [esp + 0x840]
push ecx
call fcn.0044fc40
add esp, 4
test al, al
jne 0x453cc7
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.Microsoft
lea edx, [esp + 0x1548]
push edx
call edi
test eax, eax
jne 0x453ccd
mov byte [esp + 0x27], al
jmp 0x453cd2
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov byte [esp + 0x27], 1
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x453ce3
cmp eax, 0x99
jne 0x453cf2
push 0x50db44
push 8
call fcn.0043d500
add esp, 8
cmp byte [esp + 0x1f], 0
je 0x453d09
test dword [0x1038f44], 0x400000
jne 0x453ed5
cmp byte [0x10388b3], 0
je 0x453d1e
cmp byte [esp + 0x27], 0
je 0x453d1e
mov byte [esp + 0x17], 0
test dword [0x53ed8c], 0x2000
je 0x453d7a
mov ecx, dword [0x103ac1c]
xor esi, esi
test ecx, ecx
jle 0x453d7a
mov eax, dword [0x103ac18]
jmp 0x453d40
test esi, esi
jl 0x453de8
cmp esi, ecx
jge 0x453de8
mov edx, dword [eax + esi*4]
cmp dword [edx - 0xc], 0
je 0x453d75
mov eax, edx
push eax
lea eax, [esp + 0x844]
push eax
call edi
test eax, eax
jne 0x453de1
mov ecx, dword [0x103ac1c]
mov eax, dword [0x103ac18]
inc esi
cmp esi, ecx
jl 0x453d40
test dword [0x53ed8c], 0x4000
je 0x453df9
mov ecx, dword [0x103adac]
xor esi, esi
test ecx, ecx
jle 0x453df9
mov edi, dword [sym.imp.MSVCR90.dll__stricmp]
mov eax, dword [0x103ada8]
lea ecx, [ecx]
test esi, esi
jl 0x453de8
cmp esi, ecx
jge 0x453de8
mov edx, dword [eax + esi*4]
cmp dword [edx - 0xc], 0
je 0x453dda
cmp byte [esp + 0xd44], 0
je 0x453dda
mov eax, edx
push eax
lea eax, [esp + 0xd48]
push eax
call edi
add esp, 8
test eax, eax
je 0x453ded
mov ecx, dword [0x103adac]
mov eax, dword [0x103ada8]
inc esi
cmp esi, ecx
jl 0x453da0
jmp 0x453df3
mov ebx, 0x2000
jmp 0x453d7a
call sub.mfc90.dll_Ordinal_1252
or ebx, 0x4000
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
test dword [0x53ed8c], 0x8000
je 0x453e50
mov ecx, dword [0x103ad44]
xor esi, esi
test ecx, ecx
jle 0x453e50
mov eax, dword [0x103ad40]
test esi, esi
jl 0x453de8
cmp esi, ecx
jge 0x453de8
mov edx, dword [eax + esi*4]
cmp dword [edx - 0xc], 0
je 0x453e43
mov eax, edx
push eax
lea eax, [esp + 0x1548]
push eax
call edi
test eax, eax
jne 0x453e4a
mov ecx, dword [0x103ad44]
mov eax, dword [0x103ad40]
inc esi
cmp esi, ecx
jl 0x453e16
jmp 0x453e50
or ebx, 0x8000
test dword [0x53ed8c], 0x10000
je 0x453eb2
mov ecx, dword [0x103acb0]
xor esi, esi
test ecx, ecx
jle 0x453eb2
mov eax, dword [0x103acac]
lea ecx, [ecx]
test esi, esi
jl 0x453de8
cmp esi, ecx
jge 0x453de8
mov edx, dword [eax + esi*4]
cmp dword [edx - 0xc], 0
je 0x453ea5
mov eax, edx
push eax
lea eax, [esp + 0x844]
push eax
call edi
test eax, eax
jne 0x453eac
mov ecx, dword [0x103acb0]
mov eax, dword [0x103acac]
inc esi
cmp esi, ecx
jl 0x453e70
jmp 0x453eb2
or ebx, 0x10000
mov ecx, dword [0x53ed8c]
mov eax, ecx
and eax, 0x200000
je 0x453ecd
mov edx, ebx
or edx, 0x200000
cmp ecx, edx
je 0x453ed5
test eax, eax
jne 0x453eda
test ebx, ebx
je 0x453eda
mov byte [esp + 0x17], 0
mov eax, dword [0x103a97c]
cmp eax, 0x68
je 0x453ef0
cmp eax, 4
je 0x453ef0
cmp eax, 0x99
jne 0x453f29
movzx eax, byte [esp + 0x17]
movzx ecx, byte [esp + 0x27]
movzx edx, byte [esp + 0x1f]
push eax
push ecx
push edx
lea eax, [esp + 0xd50]
push eax
lea ecx, [esp + 0x1554]
push ecx
lea edx, [esp + 0x854]
push edx
push str.WhiteList_base_name__s__szSign__s__szHash__s__bBasic__d__bMS__d__bCut__d_
push 8
call fcn.0043d500
add esp, 0x20
cmp byte [esp + 0x17], 0
je 0x453fb9
push 0
lea eax, [esp + 0xf48]
push 2
push eax
call fcn.00451ad0
add esp, 0xc
test eax, eax
je 0x453fb9
cmp dword [0x103a97c], 0x47
jne 0x453f73
mov edx, dword [0x103add8]
lea ecx, [esp + 0xf44]
push ecx
push edx
push str.SendInfoDisplayBlack_1__s___s_
push 8
call fcn.0043d500
add esp, 0x10
push ebp
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x453980
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x28], 0x103
jne 0x453fad
push 0x103
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x453980
push str.EXPLORER.EXE
lea ecx, [esp + 0x844]
push ecx
call edi
test eax, eax
je 0x453fe3
push 0x103a570
lea edx, [esp + 0x844]
push edx
call edi
test eax, eax
je 0x453fe3
mov bl, 1
jmp 0x45400f
push str._svchost.exe
lea eax, [esp + 0x844]
push eax
call edi
test eax, eax
je 0x45400d
push 0x1038d30
lea ecx, [esp + 0x844]
push ecx
call edi
test eax, eax
je 0x45400d
mov bl, 1
jmp 0x45400f
xor bl, bl
mov eax, dword [0x103a97c]
cmp eax, 0x68
jne 0x454056
mov edx, dword [0x1038f3c]
and edx, 0x100000
xor eax, eax
test bl, bl
sete al
xor ecx, ecx
cmp byte [0x1038f40], cl
push edx
sete cl
lea edx, [esp + 0x844]
push eax
push ecx
push edx
push str.WhiteList_is_hook_____s__g_bWL_Child__d__isExplorer__d__g_bWhiteList__TC_DEFENCE_WL_ONLY__d_
push 8
call fcn.0043d500
mov eax, dword [0x103a97c]
add esp, 0x18
cmp byte [0x1038f40], 0
mov ecx, dword [0x1038f3c]
jne 0x454076
test bl, bl
jne 0x454076
test ecx, 0x100000
je 0x454082
jmp 0x453980
test ecx, 0x100000
jne 0x4541c4
cmp eax, 4
je 0x45408e
cmp eax, 0x99
jne 0x45409d
push 0x50da20
push 8
call fcn.0043d500
add esp, 8
lea eax, [esp + 0x840]
push eax
call fcn.0044f490
add esp, 4
test al, al
je 0x4540f5
mov eax, dword [0x1039f54]
test eax, 0x200
je 0x4540cb
mov esi, dword [0x1039f50]
test esi, esi
jne 0x454fd4
test eax, 0x800
jne 0x4541c4
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 0x10
jmp 0x454feb
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x454106
cmp eax, 0x99
jne 0x45411a
push 0x50d9f0
push 8
call fcn.0043d500
mov eax, dword [0x103a97c]
add esp, 8
test dword [0x1038d14], 0x4000
mov edi, dword [sym.imp.MSVCR90.dll_strstr]
je 0x45414b
lea ecx, [esp + 0x840]
push str._spoolsv.exe
push ecx
call edi
add esp, 8
test eax, eax
jne 0x453980
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x454157
cmp eax, 0x99
jne 0x454166
push str._t_t_tCanHookDeep_TYPE_PRINTER
push 8
call fcn.0043d500
add esp, 8
push 0x1ff
lea edx, [esp + 0x2549]
push 0
push edx
mov byte [esp + 0x2550], 0
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.MSVCR90.dll_sprintf]
push ebp
lea eax, [esp + 0x2554]
push 0x4ff1b8
push eax
call esi
add esp, 0x18
test byte [0x1038f44], 4
je 0x4541e2
lea ecx, [esp + 0x840]
push str.rstrui.exe
push ecx
call edi
add esp, 8
test eax, eax
je 0x4541e2
mov ecx, dword [esp + 0x30]
push ebp
call fcn.0044dac0
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x2c]
jmp 0x454feb
test dword [0x1038d14], 0x400000
jne 0x454244
lea edx, [esp + 0x840]
push str._screensketch.exe
push edx
call edi
add esp, 8
test eax, eax
jne 0x45421a
lea eax, [esp + 0x840]
push str._snippingtool.exe
push eax
call edi
add esp, 8
test eax, eax
je 0x454244
push 0
lea ecx, [esp + 0x844]
push 0x400000
push ecx
call fcn.00451ad0
add esp, 0xc
test eax, eax
je 0x454244
mov ecx, dword [esp + 0x30]
push ebp
call fcn.0044dac0
call fcn.004511d0
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x454255
cmp eax, 0x99
jne 0x454264
push str._t_t_tCanHookDeep_TYPE_SCREENSHOT
push 8
call fcn.0043d500
add esp, 8
lea edx, [esp + 0x840]
push str.bitlockerwizardelev.exe
push edx
call edi
add esp, 8
test eax, eax
je 0x4542d0
test dword [0x10430e4], 0x200000
je 0x4542a2
lea eax, [esp + 0x840]
push eax
push str.except_process___s_
push 8
call fcn.0043d500
add esp, 0xc
jmp 0x453980
push 0x5116d8
lea ecx, [esp + 0x844]
push 1
push ecx
call fcn.00451ad0
add esp, 0xc
test eax, eax
je 0x453980
mov ecx, dword [esp + 0x30]
push ebp
call fcn.0044dac0
jmp 0x453980
test byte [0x1038f48], 4
jne 0x4542e9
test dword [0x1038d24], 0x2000000
je 0x454d2a
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x4542fa
cmp eax, 0x99
jne 0x454309
push 0x50d944
push 8
call fcn.0043d500
add esp, 8
push 0x3ff
lea edx, [esp + 0x2149]
push 0
push edx
mov byte [esp + 0x2150], 0
call sub.MSVCR90.dll_memset
push 0x3ff
lea eax, [esp + 0x1155]
push 0
push eax
mov byte [esp + 0x115c], 0
call sub.MSVCR90.dll_memset
push 0x3ff
lea ecx, [esp + 0x1761]
push 0
push ecx
mov byte [esp + 0x1768], 0
call sub.MSVCR90.dll_memset
push 0x400
lea edx, [esp + 0x116c]
push edx
lea eax, [esp + 0x86c]
push 0x50aa74
push eax
call fcn.0044dde0
lea ecx, [esp + 0x1178]
push ecx
call dword [sym.imp.MSVCR90.dll__strlwr]
lea edx, [esp + 0x117c]
push edx
lea eax, [esp + 0x1780]
push str.:_s:
push eax
call esi
add esp, 0x44
lea ecx, [esp + 0x1144]
push ecx
lea edx, [esp + 0x2148]
push str._s
push edx
call esi
mov eax, dword [0x103a97c]
add esp, 0xc
cmp eax, 0x47
je 0x4543d4
cmp eax, 4
je 0x4543d4
cmp eax, 0x99
jne 0x4543f3
lea eax, [esp + 0x1144]
push eax
lea ecx, [esp + 0x844]
push ecx
push str._t_t_t_tGetFileDescription___s___s_
push 8
call fcn.0043d500
add esp, 0x10
push 0x1ff
lea edx, [esp + 0xd49]
push 0
push edx
mov byte [esp + 0xd50], 0
call sub.MSVCR90.dll_memset
lea eax, [esp + 0xd50]
push eax
lea ecx, [esp + 0x850]
push ecx
call fcn.0044a8c0
add esp, 0x14
test dword [0x10430dc], 0x400
mov byte [esp + 0x17], 0
je 0x454487
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, str.process_hacker
cmp byte [esi], 0
je 0x454487
push esi
lea edx, [esp + 0x1748]
push edx
call edi
test eax, eax
jne 0x454473
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x454460
sub eax, edx
lea esi, [esi + eax + 1]
test esi, esi
jne 0x454443
jmp 0x454487
push 0
lea eax, [esp + 0x844]
push 4
push eax
call fcn.00451ad0
add esp, 0xc
test byte [0x1038f48], 4
mov ebp, 0x73
je 0x454be5
mov eax, dword [0x103add8]
cmp dword [eax - 0xc], 2
jle 0x454be5
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str..dll
push eax
call ebx
test eax, eax
je 0x4545f6
push 0x800
lea ecx, [esp + 0x44]
push 0
push ecx
call sub.MSVCR90.dll_memset
push 0x3ff
lea edx, [esp + 0x2755]
push 0
push edx
mov byte [esp + 0x275c], 0
call sub.MSVCR90.dll_memset
push 0x3ff
lea eax, [esp + 0x1b61]
push 0
push eax
mov byte [esp + 0x1b68], 0
call sub.MSVCR90.dll_memset
mov edi, dword [esp + 0x58]
add esp, 0x24
lea ecx, [esp + 0x34]
push ecx
push 0x800
lea edx, [esp + 0x48]
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
xor esi, esi
test eax, eax
je 0x4545f6
lea ecx, [ecx]
mov eax, dword [esp + 0x34]
shr eax, 2
cmp esi, eax
jae 0x4545f6
mov edx, dword [esp + esi*4 + 0x40]
push 0x3ff
lea ecx, [esp + 0x2748]
push ecx
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [esp + 0x1b44]
push eax
lea ecx, [esp + 0x2748]
push ecx
call fcn.0044a8c0
add esp, 8
push str..dll
lea edx, [esp + 0x1b48]
push edx
call ebx
test eax, eax
je 0x4545c5
cmp dword [0x103a97c], ebp
jne 0x4545a7
mov eax, dword [0x103add8]
push eax
lea ecx, [esp + 0x1b48]
push ecx
push str.loop_g_tc_BlackList_Found_Module_0__s__in_Apps__s___
push 0
call fcn.0043d500
add esp, 0x10
cmp byte [esp + 0x1b44], 0
je 0x4545c5
mov eax, dword [0x103add8]
lea edx, [esp + 0x1b44]
push edx
push eax
call ebx
test eax, eax
jne 0x4545cb
inc esi
jmp 0x454530
cmp dword [0x103a97c], ebp
jne 0x4545f1
mov ecx, dword [0x103add8]
push ecx
lea edx, [esp + 0x1b48]
push edx
push str.loop_g_tc_BlackList_Found_Module_1__s__in_Apps__s_
push 0
call fcn.0043d500
add esp, 0x10
mov byte [esp + 0x17], 1
cmp byte [esp + 0x1144], 0
je 0x45465d
lea eax, [esp + 0x1144]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x454610
sub eax, edx
cmp eax, 3
jbe 0x45465d
mov ecx, dword [0x103add8]
lea eax, [esp + 0x1744]
push eax
push ecx
call ebx
test eax, eax
je 0x45465d
cmp dword [0x103a97c], ebp
jne 0x454658
mov eax, dword [0x103add8]
lea edx, [esp + 0x1744]
push edx
push eax
push str.SendInfoDisplayBlack_bDLL__true__s___s_
push 0
call fcn.0043d500
add esp, 0x10
mov byte [esp + 0x17], 1
mov ecx, dword [esp + 0x2f60]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00450bc0
add esp, 8
mov byte [esp + 0x2f50], 1
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push 0x104
lea eax, [esp + 0xc44]
push 0
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [0x10707dc]
add esp, 0xc
cmp dword [0x10707f0], eax
je 0x4546ca
mov ecx, dword [0x103ac64]
mov edx, dword [0x103add8]
push ecx
push edx
push str.Invalid_BlackList_member__CanHookDeepg_tc_BlackList:___s_g_tc_BlackListVer:___s_
push 0
call fcn.0043d500
add esp, 0x10
jmp 0x454bd3
xor edi, edi
test eax, eax
jle 0x454bd3
lea ebp, [edi + 1]
cmp dword [0x103a97c], 0x73
mov byte [esp + 0xc40], 0
mov byte [esp + 0x1744], 0
jne 0x454742
test edi, edi
jl 0x453de8
cmp edi, dword [0x10707f0]
jge 0x453de8
cmp edi, eax
jge 0x453de8
mov ecx, dword [0x10707ec]
mov edx, dword [ecx + edi*4]
lea eax, [esp + 0x840]
push eax
mov eax, dword [0x10707d8]
mov ecx, dword [eax + edi*4]
push edx
movzx edx, byte [esp + 0x1f]
push ecx
push edx
push edi
push str.__d___d_loop_g_tc_BlackList_Split_found____s___s_in_Apps__s_
push 0
call fcn.0043d500
mov eax, dword [0x10707dc]
add esp, 0x1c
test edi, edi
jl 0x453de8
cmp edi, eax
jge 0x453de8
mov eax, dword [0x10707d8]
mov ecx, dword [eax + edi*4]
cmp dword [ecx - 0xc], 0
mov esi, dword [sym.imp.MSVCR90.dll_strstr]
je 0x454800
mov eax, ecx
push eax
lea edx, [esp + 0x844]
push edx
call esi
add esp, 8
test eax, eax
jne 0x4547be
cmp edi, dword [0x10707dc]
jge 0x453de8
mov eax, dword [0x10707d8]
mov eax, dword [eax + edi*4]
push eax
lea ecx, [esp + 0x1148]
push ecx
call esi
add esp, 8
test eax, eax
je 0x454800
lea eax, [esp + 0x1144]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4547b0
sub eax, edx
cmp eax, 3
jbe 0x454800
lea edx, [esp + 0xd44]
push edx
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2f50], 2
mov eax, dword [eax]
or dword [esp + 0x20], ebp
push eax
mov ecx, 0x745a34
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x4547fc
mov eax, dword [0x742dd0]
cmp eax, dword [esp + 0x2f60]
je 0x454800
mov bl, 1
jmp 0x454802
xor bl, bl
mov dword [esp + 0x2f50], ebp
test byte [esp + 0x20], 1
je 0x45481f
and dword [esp + 0x20], 0xfffffffe
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
je 0x4549fc
cmp edi, dword [0x10707f0]
jge 0x453de8
mov ecx, dword [0x10707ec]
mov edx, dword [ecx + edi*4]
cmp dword [edx - 0xc], 0
je 0x454967
cmp byte [esp + 0xc40], 0
jne 0x454868
lea eax, [esp + 0xc40]
push eax
lea ecx, [esp + 0x844]
push ecx
call fcn.004514f0
add esp, 8
cmp dword [0x103a97c], 0x73
jne 0x45489e
cmp edi, dword [0x10707f0]
jge 0x453de8
mov edx, dword [0x10707ec]
mov eax, dword [edx + edi*4]
push eax
lea ecx, [esp + 0xc44]
push ecx
push str.vers___s__m_sBlackListVer__s_
push 0
call fcn.0043d500
add esp, 0x10
cmp byte [esp + 0xc40], 0
je 0x4548d3
cmp edi, dword [0x10707f0]
jge 0x453de8
mov edx, dword [0x10707ec]
mov eax, dword [edx + edi*4]
push eax
lea eax, [esp + 0xc44]
push eax
call esi
add esp, 8
test eax, eax
je 0x454b10
cmp edi, dword [0x10707f0]
jge 0x453de8
mov ecx, dword [0x10707ec]
mov edx, dword [ecx + edi*4]
push edx
lea eax, [esp + 0xc44]
push eax
lea ecx, [esp + 0x174c]
push str.FileVersion:_s___found___s_
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x10
cmp dword [0x103a97c], 0x73
jne 0x4549bb
cmp edi, dword [0x10707f0]
jge 0x453de8
cmp edi, dword [0x10707dc]
jge 0x453de8
mov edx, dword [0x10707ec]
mov eax, dword [edx + edi*4]
push eax
mov eax, dword [0x10707d8]
lea ecx, [esp + 0xc44]
push ecx
mov ecx, dword [eax + edi*4]
lea edx, [esp + 0x848]
push edx
movzx edx, byte [esp + 0x23]
push ecx
push edx
push edi
push str.__d___d_OK_g_tc_BlackList_Split_found___s_in_Apps__s_vers__s_m_sBlackListVer__s_
push 0
call fcn.0043d500
add esp, 0x20
jmp 0x4549bb
cmp byte [esp + 0x1144], 0
je 0x4549bb
cmp edi, dword [0x10707dc]
jge 0x453de8
mov eax, dword [0x10707d8]
mov eax, dword [eax + edi*4]
push eax
lea ecx, [esp + 0x1148]
push ecx
call esi
add esp, 8
test eax, eax
je 0x4549bb
push edi
mov ecx, 0x10707d4
call fcn.004094e0
mov edx, dword [eax]
push edx
lea eax, [esp + 0x1748]
push str.FileDescription_found___s_
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0xd44]
push ecx
mov ecx, 0x745a34
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ebx, dword [esp + 0x2f60]
lea edx, [esp + 0x1744]
push edx
lea eax, [esp + 0x844]
push ebp
push eax
mov dword [0x742dd0], ebx
call fcn.00451ad0
add esp, 0xc
test eax, eax
jne 0x454b24
cmp edi, dword [0x10707f0]
jge 0x453de8
mov ecx, dword [0x10707ec]
mov edx, dword [ecx + edi*4]
cmp dword [edx - 0xc], 0
jne 0x454a86
cmp edi, dword [0x10707dc]
jge 0x453de8
mov eax, dword [0x10707d8]
mov ecx, dword [eax + edi*4]
cmp dword [ecx - 0xc], 0
je 0x454a86
mov edx, dword [esp + 0x28]
mov eax, ecx
push eax
push edx
call esi
add esp, 8
test eax, eax
je 0x454a86
lea eax, [esp + 0xd44]
push eax
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2f50], 3
mov eax, dword [eax]
or dword [esp + 0x20], 2
push eax
mov ecx, 0x745a34
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x454a82
mov ecx, dword [esp + 0x2f60]
cmp dword [0x742dd0], ecx
je 0x454a86
mov bl, 1
jmp 0x454a88
xor bl, bl
mov dword [esp + 0x2f50], ebp
test byte [esp + 0x20], 2
je 0x454aa5
and dword [esp + 0x20], 0xfffffffd
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
je 0x454b10
lea edx, [esp + 0xd44]
push edx
mov ecx, 0x745a34
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x2f60]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push str.cmd__
push edx
mov dword [0x742dd0], eax
call fcn.00410070
mov byte [esp + 0x2f5c], 4
mov eax, dword [eax]
push eax
lea eax, [esp + 0x850]
push ebp
push eax
call fcn.00451ad0
add esp, 0x18
mov esi, eax
mov byte [esp + 0x2f50], 1
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test esi, esi
jne 0x454b82
mov eax, dword [0x10707dc]
add edi, ebp
cmp edi, eax
jl 0x4546d7
jmp 0x454bce
cmp dword [0x103a97c], 0x73
jne 0x454b7f
cmp edi, dword [0x10707f0]
jge 0x453de8
cmp edi, dword [0x10707dc]
lea eax, [edi*4]
jge 0x453de8
lea ecx, [esp + 0xc40]
push ecx
mov ecx, dword [0x10707ec]
lea edx, [esp + 0x844]
push edx
mov edx, dword [ecx + eax]
mov ecx, dword [0x10707d8]
push edx
mov edx, dword [ecx + eax]
push edx
push str.SendInfoDisplayBlack_g_tc_BlackList_Split_found___s___s_in_Apps__s___s_
push 0
call fcn.0043d500
add esp, 0x18
push ebx
jmp 0x454bc5
cmp dword [0x103a97c], 0x73
jne 0x454bbd
cmp edi, dword [0x10707dc]
jge 0x453de8
mov eax, dword [esp + 0x28]
mov edx, dword [0x10707d8]
push eax
mov eax, dword [edx + edi*4]
lea ecx, [esp + 0x844]
push ecx
push eax
push str.loop_SendInfoDisplayBlack_g_tc_BlackList_Split_found___s_in_Apps_lpCmdLine__s___s_
push 0
call fcn.0043d500
add esp, 0x14
mov ecx, dword [esp + 0x2f60]
push ecx
mov ecx, dword [esp + 0x34]
call fcn.0044dac0
mov ebp, 0x73
mov byte [esp + 0x2f50], 0
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test dword [0x1038d24], 0x2000000
je 0x454d2a
cmp byte [esp + 0x1144], 0
je 0x454d2a
mov eax, dword [0x103acd8]
lea edx, [esp + 0x2144]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x454d2a
lea ecx, [esp + 0xd44]
push ecx
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2f50], 5
mov eax, dword [eax]
or dword [esp + 0x20], 4
push eax
mov ecx, 0x745a34
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x454c63
mov edx, dword [esp + 0x2f60]
cmp dword [0x742dd0], edx
jne 0x454c63
xor bl, bl
jmp 0x454c65
mov bl, 1
mov dword [esp + 0x2f50], 0
test byte [esp + 0x20], 4
je 0x454c86
and dword [esp + 0x20], 0xfffffffb
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
je 0x454d2a
cmp dword [0x103a97c], ebp
jne 0x454cb4
mov ecx, dword [0x103acd8]
lea eax, [esp + 0x2144]
push eax
push ecx
push str.TYPE_MESSENGERTITLE__s___s_
push 8
call fcn.0043d500
add esp, 0x10
lea edx, [esp + 0xd44]
push edx
mov ecx, 0x745a34
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x2f60]
push 0
lea ecx, [esp + 0x844]
push 0
push ecx
mov dword [0x742dd0], eax
call fcn.00451ad0
add esp, 0xc
test eax, eax
je 0x454d2a
cmp dword [0x103a97c], ebp
jne 0x454d19
mov ecx, dword [0x103acd8]
lea edx, [esp + 0x840]
push edx
lea eax, [esp + 0x2148]
push eax
push ecx
push str.SendInfoDisplayBlack_TYPE_MESSENGERTITLE__s___s___s_
push 8
call fcn.0043d500
add esp, 0x14
mov edx, dword [esp + 0x2f60]
mov ecx, dword [esp + 0x30]
push edx
call fcn.0044dac0
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x454d3b
cmp eax, 0x99
jne 0x454d4a
push 0x50d5c8
push 8
call fcn.0043d500
add esp, 8
mov esi, dword [sym.imp.MSVCR90.dll_strstr]
lea eax, [esp + 0x840]
push str.taskmgr.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x454d82
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor eax, eax
jmp 0x454feb
lea ecx, [esp + 0x840]
push str.goclean.exe
push ecx
call esi
add esp, 8
test eax, eax
jne 0x454d66
lea edx, [esp + 0x840]
push str.alftp.exe
push edx
call esi
add esp, 8
test eax, eax
je 0x454dcd
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 3
jmp 0x454feb
lea eax, [esp + 0x840]
push str.line.exe
push eax
call esi
add esp, 8
test eax, eax
jne 0x454dae
lea ecx, [esp + 0x840]
push str.gom.exe
push ecx
call esi
add esp, 8
test eax, eax
jne 0x454dae
lea edx, [esp + 0x840]
push str.filezilla.exe
push edx
call esi
add esp, 8
test eax, eax
je 0x454e2e
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 5
jmp 0x454feb
test byte [0x742ddc], 0x10
je 0x454e82
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.Office16
lea eax, [esp + 0x844]
push eax
call edi
test eax, eax
jne 0x454e63
push str.Office19
lea ecx, [esp + 0x844]
push ecx
call edi
test eax, eax
je 0x454e82
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 4
jmp 0x454feb
lea edx, [esp + 0x840]
push str.itunes.exe
push edx
call esi
add esp, 8
test eax, eax
je 0x454eb7
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 0xa
jmp 0x454feb
lea eax, [esp + 0x840]
push str.iexplore.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x454ef8
cmp dword [0x53f200], 0x601
jg 0x454e63
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 8
jmp 0x454feb
lea ecx, [esp + 0x840]
push str.devenv.exe
push ecx
call esi
add esp, 8
test eax, eax
je 0x454f2d
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 0x20
jmp 0x454feb
push 0
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_899]
test al, al
je 0x454f53
lea edx, [esp + 0x840]
push str.sqlservr.exe
push edx
call esi
add esp, 8
test eax, eax
jne 0x454f0e
lea eax, [esp + 0x840]
push str.mssql.exe
push eax
call esi
add esp, 8
test eax, eax
jne 0x454f0e
lea ecx, [esp + 0x840]
push str.sqlwriter.exe
push ecx
call esi
add esp, 8
test eax, eax
jne 0x454f0e
lea edx, [esp + 0x840]
push str.imoncmd_
push edx
call esi
add esp, 8
test eax, eax
jne 0x453980
mov eax, dword [0x103a97c]
cmp eax, 4
je 0x454faa
cmp eax, 0x99
jne 0x454fb9
push str._t_t_tCanHookDeep_end
push 8
call fcn.0043d500
add esp, 8
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x2c]
jmp 0x454feb
mov dword [esp + 0x2f50], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
mov ecx, dword [esp + 0x2f48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2f30]
xor ecx, esp
call fcn.004e0148
add esp, 0x2f40
ret 0x10