Function at 0x100050d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x400
push ebx
mov eax, str.Mcshield.exe
push esi
push edi
mov dword [esp + 0x14], str.360tray.exe
mov dword [esp + 0x18], 0x10012a44
mov dword [esp + 0x1c], str.360sd.exe
mov dword [esp + 0x20], str.360
mov dword [esp + 0x24], str.a2guard.exe
mov dword [esp + 0x28], str.a_squared
mov dword [esp + 0x2c], str.ad_watch.exe
mov dword [esp + 0x30], str.Lavasoft
mov dword [esp + 0x34], str.cleaner8.exe
mov dword [esp + 0x38], str.The_Cleaner
mov dword [esp + 0x3c], str.vba32lder.exe
mov dword [esp + 0x40], str.vb32
mov dword [esp + 0x44], str.MongoosaGUI.exe
mov dword [esp + 0x48], str.Mongoosa
mov dword [esp + 0x4c], str.CorantiControlCenter32.exe
mov dword [esp + 0x50], str.Coranti2012
mov dword [esp + 0x54], str.F_PROT.EXE
mov dword [esp + 0x58], str.F_PROT
mov dword [esp + 0x5c], str.CMCTrayIcon.exe
mov dword [esp + 0x60], str.CMC
mov dword [esp + 0x64], str.K7TSecurity.exe
mov dword [esp + 0x68], 0x10012924
mov dword [esp + 0x6c], str.UnThreat.exe
mov dword [esp + 0x70], str.UnThreat
mov dword [esp + 0x74], str.CKSoftShiedAntivirus4.exe
mov dword [esp + 0x78], str.Shield_Antivirus
mov dword [esp + 0x7c], str.AVWatchService.exe
mov dword [esp + 0x80], str.VIRUSfighter
mov dword [esp + 0x84], str.ArcaTasksService.exe
mov dword [esp + 0x88], str.ArcaVir
mov dword [esp + 0x8c], str.iptray.exe
mov dword [esp + 0x90], str.Immunet
mov dword [esp + 0x94], str.PSafeSysTray.exe
mov dword [esp + 0x98], str.PSafe
mov dword [esp + 0x9c], str.nspupsvc.exe
mov dword [esp + 0xa0], str.nProtect
mov dword [esp + 0xa4], str.SpywareTerminatorShield.exe
mov dword [esp + 0xa8], str.SpywareTerminator
mov dword [esp + 0xac], str.BKavService.exe
mov dword [esp + 0xb0], str.Bkav
mov dword [esp + 0xb4], str.MsMpEng.exe
mov dword [esp + 0xb8], str.Microsoft_Security_Essentials
mov dword [esp + 0xbc], str.SBAMSvc.exe
mov dword [esp + 0xc0], str.VIPRE
mov dword [esp + 0xc4], str.ccSvcHst.exe
mov dword [esp + 0xc8], str.Norton
mov dword [esp + 0xcc], str.QQ.exe
mov dword [esp + 0xd0], 0x10012774
mov dword [esp + 0xd4], str.f_secure.exe
mov dword [esp + 0xd8], 0x1001275c
mov dword [esp + 0xdc], str.avp.exe
mov dword [esp + 0xe0], 0x10012748
mov dword [esp + 0xe4], str.KvMonXP.exe
mov dword [esp + 0xe8], 0x10012730
mov dword [esp + 0xec], str.RavMonD.exe
mov dword [esp + 0xf0], 0x10012718
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], 0x10012710
mov dword [esp + 0xfc], str.egui.exe
mov dword [esp + 0x100], str.NOD32
mov dword [esp + 0x104], str.kxetray.exe
mov dword [esp + 0x108], 0x100126e4
mov dword [esp + 0x10c], str.knsdtray.exe
mov dword [esp + 0x110], 0x100126c8
mov dword [esp + 0x114], str.TMBMSRV.exe
mov dword [esp + 0x118], 0x100126b0
mov dword [esp + 0x11c], str.avcenter.exe
mov dword [esp + 0x120], str.Avira_
mov dword [esp + 0x124], str.ashDisp.exe
mov dword [esp + 0x128], str.Avast
mov dword [esp + 0x12c], str.rtvscan.exe
mov dword [esp + 0x130], 0x1001265c
mov dword [esp + 0x134], str.ksafe.exe
mov dword [esp + 0x138], 0x10012644
mov dword [esp + 0x13c], str.QQPCRTP.exe
mov dword [esp + 0x140], 0x1001262c
mov dword [esp + 0x144], str.Miner.exe
mov dword [esp + 0x148], 0x10012614
mov dword [esp + 0x14c], str.AYAgent.aye
mov dword [esp + 0x150], 0x100125fc
mov dword [esp + 0x154], str.patray.exe
mov dword [esp + 0x158], 0x100125e8
mov dword [esp + 0x15c], str.V3Svc.exe
mov dword [esp + 0x160], 0x100125d0
mov dword [esp + 0x164], str.avgwdsvc.exe
mov dword [esp + 0x168], str.AVG
mov dword [esp + 0x16c], str.ccSetMgr.exe
mov dword [esp + 0x170], 0x1001259c
mov dword [esp + 0x174], str.QUHLPSVC.EXE
mov dword [esp + 0x178], str.QUICK_HEAL
mov dword [esp + 0x17c], str.mssecess.exe
mov dword [esp + 0x180], 0x10012560
mov dword [esp + 0x184], str.SavProgress.exe
mov dword [esp + 0x188], str.Sophos
mov dword [esp + 0x18c], str.fsavgui.exe
mov dword [esp + 0x190], str.F_Secure
mov dword [esp + 0x194], str.vsserv.exe
mov dword [esp + 0x198], 0x10012510
mov dword [esp + 0x19c], str.remupd.exe
mov dword [esp + 0x1a0], 0x100124f8
mov dword [esp + 0x1a4], str.FortiTray.exe
mov dword [esp + 0x1a8], 0x100124e0
mov dword [esp + 0x1ac], str.safedog.exe
mov dword [esp + 0x1b0], 0x100124cc
mov dword [esp + 0x1b4], str.parmor.exe
mov dword [esp + 0x1b8], 0x100124b4
mov dword [esp + 0x1bc], str.beikesan.exe
mov dword [esp + 0x1c0], 0x10012498
mov dword [esp + 0x1c4], str.KSWebShield.exe
mov dword [esp + 0x1c8], 0x1001247c
mov dword [esp + 0x1cc], str.TrojanHunter.exe
mov dword [esp + 0x1d0], 0x1001245c
mov dword [esp + 0x1d4], str.GG.exe
mov dword [esp + 0x1d8], 0x10012444
mov dword [esp + 0x1dc], str.adam.exe
mov dword [esp + 0x1e0], 0x10012428
mov dword [esp + 0x1e4], str.AST.exe
mov dword [esp + 0x1e8], 0x10012414
mov dword [esp + 0x1ec], str.ananwidget.exe
mov dword [esp + 0x1f0], 0x100123f4
mov dword [esp + 0x1f4], str.AVK.exe
mov dword [esp + 0x1f8], str.GData
mov dword [esp + 0x1fc], str.ccapp.exe
mov dword [esp + 0x200], str.Symantec_Norton
mov dword [esp + 0x204], str.avg.exe
mov dword [esp + 0x208], str.AVG_Anti_Virus
mov dword [esp + 0x20c], str.spidernt.exe
mov dword [esp + 0x210], str.Dr.web
mov dword [esp + 0x214], eax
mov dword [esp + 0x218], str.Mcafee
mov dword [esp + 0x21c], str.avgaurd.exe
mov dword [esp + 0x220], str.Avira_Antivir
mov dword [esp + 0x224], str.F_PROT.exe
mov dword [esp + 0x228], str.F_Prot_AntiVirus
mov dword [esp + 0x22c], str.vsmon.exe
mov dword [esp + 0x230], str.ZoneAlarm
mov dword [esp + 0x234], str.avp.exee
mov dword [esp + 0x238], str.Kaspersky
mov dword [esp + 0x23c], str.cpf.exe
mov dword [esp + 0x240], str.Comodo
mov dword [esp + 0x244], str.outpost.exe
mov dword [esp + 0x248], str.Outpost_Firewall
mov dword [esp + 0x24c], str.rfwmain.exe
mov dword [esp + 0x250], 0x100122dc
mov dword [esp + 0x254], str.kpfwtray.exe
mov dword [esp + 0x258], 0x100122c0
mov dword [esp + 0x25c], str.FYFireWall.exe
mov dword [esp + 0x260], 0x100122a4
mov dword [esp + 0x264], str.MPMon.exe
mov dword [esp + 0x268], 0x10012288
mov dword [esp + 0x26c], str.pfw.exe
mov dword [esp + 0x270], 0x10012274
mov dword [esp + 0x274], str.S.exe
mov dword [esp + 0x278], 0x10012264
mov dword [esp + 0x27c], str.1433.exe
mov dword [esp + 0x280], 0x1001224c
mov dword [esp + 0x284], str.DUB.exe
mov dword [esp + 0x288], 0x1001223c
mov eax, 0x10012238
mov ecx, 0x10
mov dword [esp + 0x29c], eax
mov dword [esp + 0x2a0], eax
xor eax, eax
lea edi, [esp + 0x2a4]
mov dword [esp + 0x28c], str.ServUDaemon.exe
mov dword [esp + 0x290], 0x10012220
mov dword [esp + 0x294], str.BaiduSdSvc.exe
mov dword [esp + 0x298], 0x10012204
rep stosd dword es:[edi], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.CreateToolhelp32Snapshot
push ebx
call esi
push str.Process32First
push ebx
mov edi, eax
call esi
push str.Process32Next
push ebx
mov dword [esp + 0x18], eax
call esi
push 0
push 2
mov dword [esp + 0x14], eax
call edi
mov edi, eax
test edi, edi
je 0x1000588f
mov eax, dword [esp + 0x14]
push 0x1001194c
push eax
mov dword [esp + 0x2ec], 0x128
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x1000588f
push ebp
lea esi, [esp + 0x18]
lea ecx, [esp + 0x2e8]
push ecx
push edi
call dword [esp + 0x1c]
test eax, eax
je 0x1000586a
mov ebp, dword [esi]
lea edx, [esp + 0x30c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10005847
lea eax, [esp + 0x2e8]
push eax
push edi
call dword [esp + 0x18]
test eax, eax
jne 0x10005821
jmp 0x1000586a
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x414]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x414]
push 0x1001194c
push eax
call ebp
mov ecx, dword [esi + 8]
add esi, 8
push 0x1001194c
push ecx
mov dword [esp + 0x2f0], 0x128
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x1000580e
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x410]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x100058b4
push 0x100121c4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x100058bf
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
add esp, 0x400
ret