Function at 0x4afb5a
Capabilities:
Copy file
Create directory
Get installed programs
Manipulate safe mode programs
Parse pe header
Persist via ginadll registry key
Persist via lnk shortcut
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry key
Query or enumerate registry value
References logon banner
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512f02
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x16dc
call fcn.005106b0
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 1
mov dword [ebp - 0xa30], 0
mov dword [ebp - 0xa2c], 0
mov dword [ebp - 0xa24], 0
push 0x56b67c
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x56b6bc
push 0x54
push 0x56b6c0
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4afc18
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.004d6d11
add esp, 8
push str.Restaurado_Acceso_a__HKLM...PoliciesExplorerRun__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4afc31
push 0x56b700
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x56b708
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x56b738
push 0x54
push 0x56b73c
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4afc8e
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.004d6d11
add esp, 8
push str.Restaurado_Acceso_a__HKLM...Run__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4afca7
push 0x56b768
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x56b770
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x56b7a4
push 0x54
push 0x56b7a8
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4afd04
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.004d6d11
add esp, 8
push str.Restaurado_Acceso_a__HKLM...RunOnce__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4afd1d
push 0x56b7d8
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x56b7e0
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x56b824
push 0x54
push 0x56b828
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4afd80
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.004d6d11
add esp, 8
push str.Restaurado_Acceso_a__HKUS...PoliciesExplorerRun__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4afd99
push 0x56b868
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x56b870
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x56b8a4
push 0x54
push 0x56b8a8
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4afdfc
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
call fcn.004d6d11
add esp, 8
push str.Restaurado_Acceso_a__HKUS...Run__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4afe15
push 0x56b8d4
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x56b8dc
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x56b914
push 0x54
push 0x56b918
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4afe78
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.004d6d11
add esp, 8
push str.Restaurado_Acceso_a__HKUS...RunOnce__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4afe91
push 0x56b948
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x56b950
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x56b988
push 0x54
push 0x56b98c
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4afef4
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.004d6d11
add esp, 8
push str.Restaurado_Acceso_a__HKUS...Windows__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4aff0d
push 0x56b9bc
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x56b9c4
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x56ba00
push 0x54
push 0x56ba04
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4aff70
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
call fcn.004d6d11
add esp, 8
push str.Restaurado_Acceso_a__HKUS...Winlogon__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4aff89
push 0x56ba38
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x56ba40
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ba44
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ba4c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ba50
mov ecx, 0x5b5b90
call fcn.0050f680
push str.645318386
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EQuick2_Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ba70
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ba94
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ba9c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56baa4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56bab0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56bab8
mov ecx, 0x5b5b90
call fcn.0050f680
push str._RemoteRegistry_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2C5F9FCC_F266_43F6_BFD7_838DAE269E11
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2C70168B_97CE_4f31_B85D_1FEC5002721D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2CF0B992_5EEB_4143_99C0_5297EF71F444
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2RTEWO9G_ENH6_V925_PZEP_C15274X8KVHZ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2YK4LNMZ_NKML_EH4X_A4X7_IOORCHADG5UB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38OO11Q4_NW1K_CK2W_HSA_FULZE84IOCRG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.39B6FD42_8SKE_838D_9875_3YTA2897936Q
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3G5SF54X_7ZOB_LH2W_7YGL_7B2WQ2DZ1XMP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3YAU7E57_FGF_Z2FI_Q1VN_ERFDAUC5W6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.42XNB7LV_SSYZ_8E1B_H2GM_FYBFEWYKAEHY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4CVON33B_3WME_IFWY_56D4_RCOD1YYYILZ8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4SWZOBX_H91P_S614_OG1S_IZFAPF2HM3EY
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56bcb4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.61ICPSGQ_ZAMI_FA72_UWQ6_2YDWACNPPLA9
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56bd04
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7DD4A7AC_A3F1_4495_884A_7947C5B89108
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7FPML23_HO35_C4H4_XMZU_OUVMZ3CLH4D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8ST6T9C2_8T53_7BW9_ECR4_C3AGY559BA5F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9754B85A_3B34_4969_BE1F_CD03227E9470
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56bdf4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BAAA759D_56F0_428c_B8DA_827EA3B08C2C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BNBZZ1LZ_D17V_X6Y1_4IEX_YTZ5TVG2794A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BVEOC265_3CHK_OQ_TGNO_7771VAWOQMM4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56be94
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CLBOUSZ_KYMT_A8NI_PMKH_M5COSTU3CC9K
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CV478E_O99ER_MNB123_MNB123
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DD651081_A909_45ad_BD71_2335B0ADE043
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DWTBV1MF_M5DL_6QN_EADY_BTOAE3TYVG5G
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ECF5669D_61C9_DEB1_BDAF_89C8566211F4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FF45O_POL9___IOP_LKMN12_KJH34
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FKRGG2Y_UVR1_S7RQ_L11H_T4ZQUKTB5YI5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GHWONL6M_XGH2_ECOA_HDV_MAS8937ME11
mov ecx, 0x5b5b90
call fcn.0050f680
push str.H6ONSADF_TWHD_O5US_R3Z_9TC3UTAOIOBI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KFS82SXO_CKIG_LALI_U2E6_W7D2N9XLQEP2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KY4AYM4E_YXQR_Z37M_XSIX_K4QAX3E3PX2I
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MH2U5UC7_3RLL_POQK_38MI_HNL5HSPBWP1T
mov ecx, 0x5b5b90
call fcn.0050f680
push str.U869M8IS_EXVY_C6AP_BYXB_WXOU7BTSAI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.V7KD6PDH_HNLV_DYZ_2GFW_I35OI61Q29IV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.X8UBSS2H_P4WM_NQ1M_D9I5_NEO3LSUS1HR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ZZYYFPDT_V9EI_XD6U_AXBC_8OTCO59KRZ93
mov ecx, 0x5b5b90
call fcn.0050f680
push str.69_9C_C6_63_DW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.76_67_77_71_DW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9D_DA_A2_2E_DW
mov ecx, 0x5b5b90
call fcn.0050f680
push str._binSched.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.helphst.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str._Desconocido_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.001.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.00105AE23642
mov ecx, 0x5b5b90
call fcn.0050f680
push str.021_251860923_12_5_1_S_
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c1cc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B33A04968FA533E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0x433A5C417070446174615C4C6F63616C5C54656D705C526470536150726F7879
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0x433A5C446F63756D656E747320616E642053657474696E67735C5365725C42696E6741534453
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0x433A5C417070446174615C4C6F63616C5C54656D705C4D617878417564696F4D65746572733634
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0x433A5C446F63756D656E747320616E642053657474696E67735C5365725C417070446174615C636D737470
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0x433A5C446F63756D656E747320616E642053657474696E67735C5365725C417070446174615C61637070616765
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c3ac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1069011274
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12_23_dst
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12CFG214_K641_12SF_N85P
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c3e8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1G6R
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1MLtmRlWGgAL9Tzah
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1payday
mov ecx, 0x5b5b90
call fcn.0050f680
push str.223_1876133383_12_5_1_S_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2345Soft
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c43c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2baby
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2f70f1f035a5e47889b71ca45683931e
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2fe5a27cde066c0b65acb8f2c1717464
mov ecx, 0x5b5b90
call fcn.0050f680
push str.309238237642632732844983472832893
mov ecx, 0x5b5b90
call fcn.0050f680
push str.312312421412
mov ecx, 0x5b5b90
call fcn.0050f680
push str.32NFG94_H61_2SF_N1P_5M1ERH6L6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.339a76a2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.360_Patch_Up
mov ecx, 0x5b5b90
call fcn.0050f680
push str.360safe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.385831572
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3yTx3yj6uQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4423bc470f298aa3aa0f1025f8454e32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c548
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4w1IjgBXP4HGv63
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5bcfe47f9d530972c2e2d7e68c57b77a
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6809a0a31fd7d384863a24815e35ee52
mov ecx, 0x5b5b90
call fcn.0050f680
push str.681610782452
mov ecx, 0x5b5b90
call fcn.0050f680
push str.737944d09cccf760440837f88b40a02f
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7d6044e95a16761171b130dcb476a43e
mov ecx, 0x5b5b90
call fcn.0050f680
push str.875ut6yyy6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.87654hgff
mov ecx, 0x5b5b90
call fcn.0050f680
push str.888.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8888
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8L00nXTcU
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9869da81
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9MCEVQZmSx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aaaaspex
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AAEFAFDDEECFCABFEAAB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aaprotect
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c688
mov ecx, 0x5b5b90
call fcn.0050f680
push str.abfiv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ABsound.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.acmigration
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Acrndtd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Acronis
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ActionMarc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Activation
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c73c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.adaptermob
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AddClass
mov ecx, 0x5b5b90
call fcn.0050f680
push str.adir
mov ecx, 0x5b5b90
call fcn.0050f680
push str.admin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Administrator
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c784
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adobe_Driver_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adobe_Flash_Player
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adobe_PDF_reader.
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adobe_Reader_Updater_c7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adobe_Reader_Updater_S2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adobe_Reader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adobe2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AdobeCVC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.adobeflash
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c828
mov ecx, 0x5b5b90
call fcn.0050f680
push str.adobes
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AdopeFlash
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AdopeUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.adptserv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ADSFDGFHGJHKJJH
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Advanced_Virus_Remover
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AdVantage_Setup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.advap32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adware.Srv32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c8b0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aEmokNON
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c8c8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Afhvlen5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.afklesafskilre
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Afyxoxgok
mov ecx, 0x5b5b90
call fcn.0050f680
push str.agent
mov ecx, 0x5b5b90
call fcn.0050f680
push str.agent.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c90c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ahan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ahead_Nero
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ahnsoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Alchem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Alcmtr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AlcxMonitor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.algdll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ALGU.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Aljkqj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.alkk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.allocatur
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Allophones
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AltnetPointsManager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Alxtsaxxv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Amor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.amoumain
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56c9c0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.amva
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ANAGOGIE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ankomst6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Anscrdlp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.antiboot
mov ecx, 0x5b5b90
call fcn.0050f680
push str.antihost
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ca10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.antispy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Antitoksiner
mov ecx, 0x5b5b90
call fcn.0050f680
push str.antiviirus
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ca40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AntiVirus_AntiSpyware_2011_Security
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ca80
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ca98
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Antivirus_Protection_2012_SH
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Antivirus_Protection_2012_SM
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56caf4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cb0c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cb18
mov ecx, 0x5b5b90
call fcn.0050f680
push str.antivirus_2008pro.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AntivirusAVG
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cb50
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Antivirus_Pro_2010
mov ecx, 0x5b5b90
call fcn.0050f680
push str.api__1_0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Api32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ApnUpdater
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cb94
mov ecx, 0x5b5b90
call fcn.0050f680
push str.App.EXEName
mov ecx, 0x5b5b90
call fcn.0050f680
push str.appdata.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.appendix
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AppHelper
mov ecx, 0x5b5b90
call fcn.0050f680
push str.apphide
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cbd0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cbe0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.apple
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ApplicatGSFDAxion
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cc08
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Application_In_System
mov ecx, 0x5b5b90
call fcn.0050f680
push str.APPLICATTION
mov ecx, 0x5b5b90
call fcn.0050f680
push str.appplication_tool
mov ecx, 0x5b5b90
call fcn.0050f680
push str.APPS
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cc58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Aqctgzcfc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Arbejdsmaa4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ARCANGEL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Archive
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ArchivosComunesy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.arecile
mov ecx, 0x5b5b90
call fcn.0050f680
push str.arinze
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Arkivkopiens3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AS2014
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cccc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.asam
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ashQuick
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ASocksrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.asodakaossd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ASound.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cd14
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Assumm7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aswProperty64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.asynch
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AtherosMdSrvUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Athleti6
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cd58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AtiMonitor
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cd68
mov ecx, 0x5b5b90
call fcn.0050f680
push str.atmfrepl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.atmpsnap
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Atomstoppene7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ATULEU
mov ecx, 0x5b5b90
call fcn.0050f680
push str.atyt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Audio_Control_Emulation
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cdbc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Audio_GD_System_Panel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Audio_HD_Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Audio_Treiber_x64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AudioClient
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AudioDriver
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ce20
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AudioHQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.audiomac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AudioMixer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.audiop2psound
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Audiotrack
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aupd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.authentic
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AutoDrum_4_4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.autoload
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AutoLoaderAproposClient
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Autonomia
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AutoStart
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cec4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AutoUpdater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Avantgardistisk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AVantivirus
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Avast
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Avast_Auto_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Avg_Antivirus
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AVG_AntiVirus_Controller
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AVG_AntiVirus_Firewall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AVG_AntiVirus_Scanner
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AVG_AntiVirus_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.avgf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.avguix
mov ecx, 0x5b5b90
call fcn.0050f680
push str.avpa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AVrSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AVSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56cfb0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ayodbxbwt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B.B_oZc_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.b1bbd3cd1f3dc3f
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B2DAD187
mov ecx, 0x5b5b90
call fcn.0050f680
push str.b393a5c55a45b59daf2cf8d0f334de58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.b3dUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B64Fu7wxCKTba7x
mov ecx, 0x5b5b90
call fcn.0050f680
push str.b76r1b9ohz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BackGround
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Backup_2017
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Backup.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.backwindow32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.backwindow132
mov ecx, 0x5b5b90
call fcn.0050f680
push str.backwindow232
mov ecx, 0x5b5b90
call fcn.0050f680
push str.backwindow332
mov ecx, 0x5b5b90
call fcn.0050f680
push str.backwindow432
mov ecx, 0x5b5b90
call fcn.0050f680
push str.backwindow532
mov ecx, 0x5b5b90
call fcn.0050f680
push str.backwindow632
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bacu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bakra
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bang
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d0e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Barsaka
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Batley
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bbbbbbbb
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d108
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BC_Client
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Belastning7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Betvingelsernes7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BFENdJEY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bgfxn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bikini
mov ecx, 0x5b5b90
call fcn.0050f680
push str.billedt
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d15c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bios
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bipw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bjmnhzewb
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d17c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Blackwealth01
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Blanktegn7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.blb_kmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bldwuitolmxrr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BlockChecker
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d1c8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bltekretje
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d1e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bmmddra
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d1f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bmsou
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bmsy
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d208
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d20c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bnye
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bogkasserne4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bond
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bootStart
mov ecx, 0x5b5b90
call fcn.0050f680
push str.boottmp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bortgikg
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d250
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bpnbwsuohrj
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d260
mov ecx, 0x5b5b90
call fcn.0050f680
push str.braviax
mov ecx, 0x5b5b90
call fcn.0050f680
push str.brastk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BrokerInfrastructure
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BrowserUpdateCheck
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Brsteformet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bryo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bsx3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bulkpage
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d2d0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.buritos
mov ecx, 0x5b5b90
call fcn.0050f680
push str.burnnls
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BurnScr
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d2fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bvsqlki
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bxxs5
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d314
mov ecx, 0x5b5b90
call fcn.0050f680
push str.c:_setupCrhome.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.c423e3fe5cea92abe6365f763ee772da
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d350
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Campanolo9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.campen
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Capite7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cashback
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cbvcs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ccbebfcbef
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cchxxhlype
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ccPrxy.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d3ac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cdoosoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cdrhvqs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CecuQrfmvIJuvYmbY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cellarer6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ceme
mov ecx, 0x5b5b90
call fcn.0050f680
push str.centosffjk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CertificatesCheck
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cewfjhjcvxu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cfgManage
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cftmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CFTMON.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.checkrun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.chgport
mov ecx, 0x5b5b90
call fcn.0050f680
push str.chimera
mov ecx, 0x5b5b90
call fcn.0050f680
push str.chitane
mov ecx, 0x5b5b90
call fcn.0050f680
push str.chkbit
mov ecx, 0x5b5b90
call fcn.0050f680
push str.chlonx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Chopan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Chorme_
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d47c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d484
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Chrome_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Chromee
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ChromeUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d4b4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d4bc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.chrorne
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d4cc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ciew
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CILSEY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cisvmapi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cisvress
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d500
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d504
mov ecx, 0x5b5b90
call fcn.0050f680
push str.clic_875
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ClickMe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d52c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.clicup_Agent
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d544
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Client_Monitor
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d55c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Client_Server_Runtime_Subsystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Client_Startup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Client_update
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d5bc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cliente
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Clients
mov ecx, 0x5b5b90
call fcn.0050f680
push str.clock
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d5e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cloud
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CloudNet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.clp.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.clrtss
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CMESys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cmitros.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cntcmd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cnthlpr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cockstart
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Coin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Command_Line_Support
mov ecx, 0x5b5b90
call fcn.0050f680
push str.commentators
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d670
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d688
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d69c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.compdefrag
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Complete1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Complete2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.COMServer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.comsetup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.comstr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.conadvanced
mov ecx, 0x5b5b90
call fcn.0050f680
push str.configbin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Configura
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Configuration_Loader
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d740
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Conime.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.conscorr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Console_Window_Host
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Content_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.contextfr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.contextprod
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Control_handler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.copyex
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Corporation
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cortana_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Corr
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d7d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.COUNTERSCONCE
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d7ec
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d7f8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cpl32ver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CPM9b5ae91d
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cpptcuba
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CPQEASYBTTN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cpsvfeirn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CPUdriver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CrashMon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CrashService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Create_Suport
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Crome
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Crome.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cron
mov ecx, 0x5b5b90
call fcn.0050f680
push str.crnss
mov ecx, 0x5b5b90
call fcn.0050f680
push str.crrss
mov ecx, 0x5b5b90
call fcn.0050f680
push str.crsscr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.crsss
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d8bc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cryptedinfo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Crypto_processor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.csimage
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d8ec
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d8f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CSRLT.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.csrsc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CSRSSU
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d918
mov ecx, 0x5b5b90
call fcn.0050f680
push str.csrss.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cssrss
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cssys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CTDrive
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CTEMON.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ctezvnscve
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ctfmgr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CTFMON
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CTFMON32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CTFMON32.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ctfmona
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ctfnom.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cthyhtxxy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ctpmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ctrlhelper
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cuban
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cuffin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Culley
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Current_User
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d9e4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d9e8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56d9f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cvhost
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56da08
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56da10
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56da18
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cwftzj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CyOa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cyanoti9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cybansos
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56da48
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56da50
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56da74
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Daaufdhieaoyd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dactylorh9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dahne_2_05
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DanBtR270414
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Date_Key_Name
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DarkComet_RAT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DbgHlp32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dcom
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dczmhtxii
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DealHelperBrwsr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DealHelperUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Debitumenize
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Debxuduk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DeComuqua
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DeComuque
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DECRYPTINFO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.default
mov ecx, 0x5b5b90
call fcn.0050f680
push str.defaultchk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Defaults
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DefencerGBA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.defender
mov ecx, 0x5b5b90
call fcn.0050f680
push str.defenderWirelessSecurityV5
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56dbcc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DEGLYCER
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DELB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Deleb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Delgviay
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DeluxeCommunications
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Demob8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56dc24
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dfghbjnkm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DFGHJ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DFGHJKJKJHG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dfghrtyu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dfhgcvhkjblkn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DGHezqOA_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dghjn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dGpDguAlnf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dgxiwfghf
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56dc94
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dhelgviay
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dialer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56dcb8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56dccc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dishonourables4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DisplaySwitch
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ditmers
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Djfiu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.djgt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.djtopr1150.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DjvuApp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DKjyMJLe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DkTime
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DKXnxTuW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dll32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dllhelp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dllhelper
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dmdlider
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dmjblmtdbve
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dmyek
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dmywyhizg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dnacls
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dnqbnalgv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56dd9c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56dda0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dnyglkmpzau
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ddbc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DomainHostingView
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dopwurdx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dorfgwe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.down
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56de00
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56de0c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dpapmob
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DPI_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dplaysvr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dpyye
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56de44
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dreqzc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Drifts
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56de64
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56de6c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56de78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DriveSystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.drivevideo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dropforg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dropspam_lifestyle
mov ecx, 0x5b5b90
call fcn.0050f680
push str.drsmartload
mov ecx, 0x5b5b90
call fcn.0050f680
push str.drsmartloadb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DRTYUIOKJHG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.drvupd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dsfgsdf_67897869
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56df00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DsNiu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dso32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dtghfkgh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ducic
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Duxdemiezai
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56df34
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56df38
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dwoaheew
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dxcfbpp
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56df50
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DyFuCA_Active_Alerts
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dzozf
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56df78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EbatesMoeMoneyMaker
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EbatesMoeMoneyMaker0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EbatesMoeMoneyMaker1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56dfc4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Eburin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ecddfgh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Echo_Comm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ecXFyRUGZ9wxh6mTH
mov ecx, 0x5b5b90
call fcn.0050f680
push str.editpad
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e004
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Eech
mov ecx, 0x5b5b90
call fcn.0050f680
push str.eetrk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ef781910bc5e8aab3761591acadf8bb6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.egpo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ehtion
mov ecx, 0x5b5b90
call fcn.0050f680
push str.eibwj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ejmellng
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e060
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e068
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Encrypter_074
mov ecx, 0x5b5b90
call fcn.0050f680
push str.engel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Enogty9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.eomsistem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.epceaqan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Epikureres7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EpromSystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.epson
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Erbonoxoqa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.erelong
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ertyuop
mov ecx, 0x5b5b90
call fcn.0050f680
push str.erwfguyhjnxcj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.erwtvsfvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Error_Safe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e108
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Esph
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Eternity
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e128
mov ecx, 0x5b5b90
call fcn.0050f680
push str.etrow
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Eubid
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Eulogic4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e148
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ewxrpfqp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ExAlien
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Exbqzyawb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Excel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Exeudmir
mov ecx, 0x5b5b90
call fcn.0050f680
push str.expandc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.expanddll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.explorador
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e1a4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.explore_explorers
mov ecx, 0x5b5b90
call fcn.0050f680
push str.exploreing
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Explorer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.explorer.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Explorer32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ExploreUpdSched
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Extensionsx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.exwuo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F43494259465
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e228
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FA_Page
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FacbookUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Facebook
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e274
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fagvuep
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e288
mov ecx, 0x5b5b90
call fcn.0050f680
push str.farettr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FastStart
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e2a4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fdhxirirf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FfXXN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fggvtoo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fhfhhffh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fhgngbcvasjgukoyplkmbnjhfhgyeth
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fifa_10_Startup_patch
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fiffyt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Filaree
mov ecx, 0x5b5b90
call fcn.0050f680
push str.filebrowser
mov ecx, 0x5b5b90
call fcn.0050f680
push str.finc70dkk.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Find
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fine
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e34c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.firefox.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e360
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e36c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e380
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Firewall
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e398
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FirewallActivies
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fIvxwJDVdGdMfCgtYuXwXFIxLX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fiyjdwaazb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fjbtnxpufdpdqg
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e3fc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e40c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Flappe2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.flash
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FlashFXP1.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FlashMdSrvUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FlashSrvUpdateMd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fnbwuh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Font_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fonts_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fookcv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FORHOLDSORDRENS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Form1post
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Form1Tric5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Foto
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fovixw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fqaecahub
mov ecx, 0x5b5b90
call fcn.0050f680
push str.framei
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Framework_Windows
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Frig9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FRISKIN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Frowslz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Frtnc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fscomp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fsdf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ftevxnut
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FtnscDnJ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fuck_this_PC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fuckuuuuu
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e53c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fUJhSEkUKMkOPz78j
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fusionsaft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fwacfnzeblz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fxsflcst
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e578
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gaclqo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Galavanted
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Games_Acceleration
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gasture
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gatert_12010
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e5c0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gavjogb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gbhway
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gbOAv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GbPluginAbn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GbPluginAbr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GbPluginBb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GbPluginCef
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GbPluginIsg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GbPluginScd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GbPluginUni
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e63c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gcghj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gdcv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gddbbbx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gdfgdf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gdgjgtfv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gemhbn
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e67c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.getmac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gevokbsybda
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e698
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gFnFILdc_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GForceUpdateMonitor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ght.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gijgxgfm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gjdoh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gkubanm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GlobalFlagUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GmailEnhancer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e70c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Golcqbwc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Goldll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google_App_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google_Chrome
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google_Chromium
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google_Inc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google_Update_12.3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e78c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e7a0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e7b4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e7c8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e7e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Googlectf
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e7fc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e80c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.goqkksd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gpsont
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gqyfdivnojbg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GreatWork
mov ecx, 0x5b5b90
call fcn.0050f680
push str.green
mov ecx, 0x5b5b90
call fcn.0050f680
push str.grLpaJrKFM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.grundk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GTFygyYG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gthvk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gtkzvinxul
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e87c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gusano
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Guvfnfttt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gvnolwksjuh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gvyizkbhbk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gwiz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gxcveyDXDi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GYHGYHH
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gzqtg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hahmkq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hahrcqyj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HandleSystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Happer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e8fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hawsemor
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56e914
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HD_AUDIO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HDAudioProcessi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hdimages
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hedgierp8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.helligbrd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.help
mov ecx, 0x5b5b90
call fcn.0050f680
push str.help.vbe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.help.vbs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HelpCont
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HelpDesk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.helperAdapter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hgfdsdfxc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hgfgihdgjyf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hgqhp.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HGTETDFYREHJKRYFRE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hh.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hhjkf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hide
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hieroglyphic2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hindbrm1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hindustan
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ea1c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hjjhear
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HJVImUUfjAsQ0VllQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hkcmd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HKCU
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HKLM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hknhlblpmn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hkyaajrsgqa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hkzkftxn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hl4q5gkwOzkP
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ea8c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hnhppluq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Holzupo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hook
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Host
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Host_process
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56eac4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Host_process_Windows__Rundll3.exe_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.host.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hostdll
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56eb20
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hotdlll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HotTVPlayer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.How_To_Recover_Encrypted_Files
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hpphmd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hpuqt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hqduamc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hqmumpt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hqvvw
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56eb84
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hsuh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HTML
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hussan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hvzwf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hwghgnt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hwjqncovk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HWMonitor
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ebd4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hxcqbknccv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hxocttvhwroxw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HYkajrcn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hzzlsg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.I3lG0y
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ec14
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Iaobqlmo
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ec48
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IComplemento
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ICompXpSp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.icon
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ec70
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IE_Redir
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iedll
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ec88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ieengine
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iefeatslUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ecb0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Iensawb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IEPR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IEXPLORER
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Iexplorerr.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Igfx.
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IgfxSys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.igfxTray32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iios
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ijeaygls
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ijhgf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IJJDN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ikxrqwdk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ilds
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ILVqQOke
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ima3ges
mov ecx, 0x5b5b90
call fcn.0050f680
push str.images.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Images1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Imagespng
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Imageview
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ImgTask
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IMJPMIG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IMJPMIG8.2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Impressoras_HP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Imxsxssaages
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56edb8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.indice
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56edc8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56edd8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ede4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ingzodxue
mov ecx, 0x5b5b90
call fcn.0050f680
push str.inijcix
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ee00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Inspector
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Install.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ee1c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.instalosta
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ee34
mov ecx, 0x5b5b90
call fcn.0050f680
push str.insys
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ee4c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Intel_i386
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Intel_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Intel_system_tool
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IntelCpHciSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.intell32.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56eea4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.intenats
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internat_Conf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Connection_Wizard
mov ecx, 0x5b5b90
call fcn.0050f680
push str.internet_explore
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ef10
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ef24
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Flash_Player_Macromedia
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Mail_and_News
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ef7c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ef90
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Security_2010
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Security_Essentials
mov ecx, 0x5b5b90
call fcn.0050f680
push str.InternetDownload_upgrade
mov ecx, 0x5b5b90
call fcn.0050f680
push str.InternetExplorer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.internets
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f018
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ions2
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f024
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ipmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IpNetWork
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f03c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Iqsevxht
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ircamreg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.irftp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iscsiresult
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f070
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Isoczsiogu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.isohelp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Isolution
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IST_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ist_service_uninstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iSvchostyiSvchosty.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.itunes
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iut75
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ivcfhbr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Iworm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IxplorerStart
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Iylqcdnbjqv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f10c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f110
mov ecx, 0x5b5b90
call fcn.0050f680
push str.JAVA__TM__UPDATER_SERVICE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Java_Machine_Debugger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Java_Platform_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f164
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f180
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f198
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Java_Update_Scheduler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Java_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Java_Updates
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Java_Updtr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.java.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f1f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.javasched
mov ecx, 0x5b5b90
call fcn.0050f680
push str.javask
mov ecx, 0x5b5b90
call fcn.0050f680
push str.JavaUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.JavaUpdateScheduler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Javax
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jdmcfworvo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jeleqromb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jfbabodo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jfrxhimgtye
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f268
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jgvjgvjbhbhj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jhgvuhyjbkj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jjred
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f294
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jlbrwaazxhb
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f2a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jnckjcfx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jnskdfmf9eldfd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Joxoyku
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f2d0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f2d4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jtjoovcwucqazqp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jucheck
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f2f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jusched
mov ecx, 0x5b5b90
call fcn.0050f680
push str.justinalwhitedd554.duckdns.org.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.JvaRuntime
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jVAZoSGiC3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.JVM0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jwnfnthg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jwvnyampmi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jzqbsob
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kamsoft
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f374
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kava
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kbdsprt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kbkb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kbnotify
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kbvypcxq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kcdizpjdv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kcfcgvzqh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kdomdv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Keeshondsfa1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f3e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kell
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kellerimages
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kemple
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kerkfomccvdsew66
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KernelCheck
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Keszie
mov ecx, 0x5b5b90
call fcn.0050f680
push str.keyboard
mov ecx, 0x5b5b90
call fcn.0050f680
push str.keymgrldr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.keysopne
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kgwyivvxe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kgydkvge
mov ecx, 0x5b5b90
call fcn.0050f680
push str.khafisc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.khanne
mov ecx, 0x5b5b90
call fcn.0050f680
push str.khaplug
mov ecx, 0x5b5b90
call fcn.0050f680
push str.khawab
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Khdvjerr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kiiyswrwr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.king_ar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.king_mg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kings2021.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kissq
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f4d0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f4d8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f4dc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Knack
mov ecx, 0x5b5b90
call fcn.0050f680
push str.knfaldet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kodak
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kolkmjnhgf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kong
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Konglomerat
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kostpengen5
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f528
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kqlrganqsc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kqrgsylgj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.krnlcom
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f550
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KUKU_INC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kvasoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KvmSecure.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kxkldp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kxva
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kyrbbc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kZnEQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.labelplay
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LAN_Cache
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lanconnect31
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lanconnect33
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lanconnect34
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lanconnect35
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lanconnect36
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lanconnect38
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lanconnect40
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f620
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lansys32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lcjmwlj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LEawmrprcqlukaA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Lector_de_documentos_Doc_de_Windows
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LEfINrnG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Lfdrtv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f68c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lgbibsn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lhjqcadxlxejk
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f6ac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LicenseValidator
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f6d0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Likvideringerne6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LimeShop
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Limnetisch
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Links
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lisecosys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lisecosys32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lisvewvvew
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f72c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LiveMessenger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lja7shayne2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lja7shayne3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lja7shayne4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lja7shayne6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lja7shayne7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lja7shayne8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lja7shayne10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ljmntf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LKJGFDXCG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lliseconc1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lliseconc2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lliseconc4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lliseconc5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lliseconc8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lliseconc8a
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lnwin.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f80c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.load32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.loader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LoadSIPS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Local_Machine
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Local_Security_Authority_Subsystem_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.localhost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Loginrun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LogOfficeDat
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Logon_de_rede
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f8a4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LogWin.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LOLPA4DESK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LosAlamos
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Lotisebqnp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LQBELC
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f8e4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lsass.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lsdefrag
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Lsdkpcwfy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ltcqz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Luqkasd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lvdbkegt
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f92c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lyqhujqrt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LzcoNrTs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.machine
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Machine_Works__Inc.
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Maigre
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mail
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f974
mov ecx, 0x5b5b90
call fcn.0050f680
push str.main
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Main_Intel_CPU_Controller
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f9a4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Malware_Doctor
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f9c4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f9d0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MalWarrior
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mantu3
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56f9f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mattheus_Merell
mov ecx, 0x5b5b90
call fcn.0050f680
push str.maxxii
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mbjuxqmt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mbmmitz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mbuvbrwo
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fa38
mov ecx, 0x5b5b90
call fcn.0050f680
push str.McAfee_RShield
mov ecx, 0x5b5b90
call fcn.0050f680
push str.McAfee_Service_Monitor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MCore86
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mcrosync_
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fa78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mdnmly
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MDNS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mdpkpmf
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fa94
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fa98
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fa9c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MediaCenter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mediaplayer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mediaplayer.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MELTER
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fadc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MensengerScr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.merium2.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Message_2017
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Message_2018
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fb24
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fb30
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fb44
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Metatarsally7
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fb5c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mgmfk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MgrWin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mhs2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Michael_Gillespie
mov ecx, 0x5b5b90
call fcn.0050f680
push str.michelangelo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Micr0soft
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fbac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.microsof
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fbc8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Agent
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_appswitch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fbf8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Cab_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.microsoft_corporation
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Defender
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Drive_Guard32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fc6c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Excel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Firewall_2.9
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fcac
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fcc0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Install_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Internet_Acceleration_Utility
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Internet_Explorer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Management_Console
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_MDM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_NT_session_Jack_Players
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_NT_sessions_Jack_Players
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_NT_Sound_Jack_Players
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fdcc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fde0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Run
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_security_adviser
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Security_Health
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Security_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Sound_EndPoint
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Sound_EndPoints
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Sound_Player
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_standard_protector
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Store
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fee8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_System_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Updates
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Windows_DHCP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Windows_Logon_Process
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Windows_Session_Manager_Subsystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Windows_System
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Windows_Templates
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56ffd4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x56fff8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570008
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_R__System_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftEdgeBrowserExporter
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570060
mov ecx, 0x5b5b90
call fcn.0050f680
push str.microsoftNT.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsofts
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftSecurity.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5700b4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftWinUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicroUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MigAutoPlay
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Milieukravene
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MingeSE_New_rat
mov ecx, 0x5b5b90
call fcn.0050f680
push str.miniw64
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57011c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MIPC
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57012c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570130
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mkdrtumey
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570140
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mlbjmttxd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mlczfe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mlffvuxh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mlibsysmc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mLVwrMsE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MNI.UWFX5Y_0001_LP1710
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mobdpap
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mobilegeni_daemon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Money_making
mov ecx, 0x5b5b90
call fcn.0050f680
push str.monitor1a
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MOREPO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Moth_Live
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5701e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MozillaAgent
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5701f8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570204
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mpybzmyqp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MQP_GWE_KKH
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mqsy
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570228
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57022c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MS_Build_56123
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MS_Shell_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MS_Virtual_CLS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ms18_word
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MS32DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MS32TMP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ms50
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSAdmin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msavsc.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5702ac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSBLT.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msbuild
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mscdti
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5702d0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5702e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msconfi
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5702f0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msconfigg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mscore
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msctrl.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msdedf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSDisp32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSDRV
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570338
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mserv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MServices
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MservicesOrg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MservicesOrg2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MservicesOrg3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSEstl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSFEEditor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msfw.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiemon.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiserver17
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiserver38
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiserver74
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiserver85
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiserver123
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiserver156
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiserver161
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msiserver226
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mskin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSMSG
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57042c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSN_Messanger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Msn_Messsenger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSNetDDNowiz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSNetDKNowiz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msnmseng
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Msnr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msnsyslog
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSODESNV7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Msoffice
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5704a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSOfficeUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msou
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5704cc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mspsmon
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5704d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msscan.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mssend
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MsServer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5704fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mssrgemmssrgem.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mssvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mssvcav
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mssys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mstwain32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msug
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSVersion
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msword
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mswords
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mswrd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSWUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570578
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Multimedia_Class_Scheduler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Multimedia_extensions
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Multiversi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mvwkufcrcx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mvyvdhigy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mwlxsp
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5705dc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5705f0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.My_Web_Search_Bar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570618
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570620
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyCloud
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyDailyHoroscope
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyFileOn
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570650
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyProgram
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mysee_Alert
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mysoftware
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570680
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyWebSearch_Email_Plugin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyWebSearch_Plugin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mzayevhg
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5706c4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.naIXBaCW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.name
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NativeCache
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nature
mov ecx, 0x5b5b90
call fcn.0050f680
push str.naturloves
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Navegate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.navisearch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570738
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57073c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nCMMgsIs.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ndjjtqsvd
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57075c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nebyzkdm.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NENDhTfcyM
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570780
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NET_Framework
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Net_Host
mov ecx, 0x5b5b90
call fcn.0050f680
push str.net64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Netbios_Helper
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nethost.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netmon
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5707d4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5707e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Netsettings
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netsv32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nett.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netw
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570814
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Network_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NetworkSubsystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netzip
mov ecx, 0x5b5b90
call fcn.0050f680
push str.New.net_Startup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.new_open
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NewJavaInstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.newname
mov ecx, 0x5b5b90
call fcn.0050f680
push str.newphone
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NextLive
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nfpglk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nfxcqrnevy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NI.UWA6PY_0001_N76M1904
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NI.UWFX5YLP_0001_0816
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nidu6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NielsenOnline
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Niveaudelt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nkenebb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nkhharel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nldenbygni
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NlugF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nmdo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nocncn_Ixmwrwfg_Qpv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nokia_Launch_Application
mov ecx, 0x5b5b90
call fcn.0050f680
push str.None
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nonplusing.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.notepaaaaddsssi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.notepaadb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Notepad
mov ecx, 0x5b5b90
call fcn.0050f680
push str.noteped
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Notification_Utility
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5709c0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nord
mov ecx, 0x5b5b90
call fcn.0050f680
push str.novelledefinitioner
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Npnhfvtou
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5709f0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nsmu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nspj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nsym
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NT_Kernel_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ntcom
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570a28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ntuser
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NtxOsDXQL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nuoslbxxt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NvBacken
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NvCcpl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nvcmd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nvhlpr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nvchost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NvEventCenter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NvGraphicsInterface
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570aa4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NVIDIA_Media_Center_Library
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NVidia32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nvstart
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NVUpdater
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570b00
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570b10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nzriqimnh
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570b20
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectdamia
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectfrigivende
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectHEBECLADOUS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objecthrderi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectLovemans
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectparketgulvet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectPostseason5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectSCRIVELLOS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectShippound8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectsmidighedens
mov ecx, 0x5b5b90
call fcn.0050f680
push str.objectSukkerroer8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570bf0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ocreanxstg
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570c04
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570c08
mov ecx, 0x5b5b90
call fcn.0050f680
push str.odby
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570c14
mov ecx, 0x5b5b90
call fcn.0050f680
push str.oe_drop_spam
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Oesi
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570c34
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570c40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Okdaybwqr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Okouxktt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Okvud
mov ecx, 0x5b5b90
call fcn.0050f680
push str.okxivnqedgtkln
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570c74
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570c80
mov ecx, 0x5b5b90
call fcn.0050f680
push str.olehelp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Olepc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.olkkmmxxzaa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Olnggruwyjc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.omdsn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.omsorg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OneNote
mov ecx, 0x5b5b90
call fcn.0050f680
push str.onSrPCkE_
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570cd4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Opbsddh
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570ce0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.opesys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Optvlldry
mov ecx, 0x5b5b90
call fcn.0050f680
push str.oqolijgtpi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.oQVORvnvRMYAMbPzXmckDfCHAlkbZc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570d28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Order
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ORGDTNQvHu
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570d44
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Osjoeyda
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Osqm
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570d5c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ostjaewbo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Outlook
mov ecx, 0x5b5b90
call fcn.0050f680
push str.overinstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Overprom
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OVSLCFOK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Owlwi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OWMngr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Oxmdfp
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570db0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pacu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Paloma_.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Panel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PAPPERNE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Payload.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PayTime
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570dfc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PCBackup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pcdfsvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pcmgr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pcocc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PCShield
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Penge
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570e40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.permsync_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Persistence___System
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570e70
mov ecx, 0x5b5b90
call fcn.0050f680
push str.personalprotector
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570e90
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570ea0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pg_ctl
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570eb4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Photoshopa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Piaqp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pinnacle.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570ee4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pioneer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PIPLXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pjxswwt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PL2d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PlataformaJava
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Platy3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.plus
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570f2c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PMG_Start
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PMsn_Paraiso
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PnNGBRKY
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570f58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.POLYEMBRY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.poommnbfde
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PopularScreensaversWallpaper
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570f94
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pozfkw
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570fa8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ppricrwjm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Prbtpzdw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.prefers
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pregam8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.presenter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Printapp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Printer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x570ff4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Printer_Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Printer_Spooler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Printspooler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Prisbelnnedespongillahom3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Privacy_Protection
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57106c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.proces
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Profiless
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Prog
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571090
mov ecx, 0x5b5b90
call fcn.0050f680
push str.progrmma
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Project1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PromoReg
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5710bc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5710d0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.propylasoc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Protector
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Prueba_de_concepto
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PSD_Tools_Channel
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57111c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571124
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ptask
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pttfvuxl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PuLAaZyrpoeHmBJuFrEPevjWoHmHKTuRZEekNZQLuR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pupdhwyswij
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pvlmhsolms
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pvocu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pvongqvyus
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pvxibfceae
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pygvv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PYQzx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pzkyjinfb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.q0L6snrIFE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qccdwzzu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.qcxza
mov ecx, 0x5b5b90
call fcn.0050f680
push str.qddjlfybywd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QetXm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.qghnhtlujfp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qirrmthco
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qjscytuqaqq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.qkjmhkerkawg
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571238
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57123c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qreoogsj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qrzgdtep
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qsvdsykhl
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571264
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571268
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Quasar_Client_Startup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.qubiafscvdn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.queryimig
mov ecx, 0x5b5b90
call fcn.0050f680
push str.quicken
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QuickShock
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qvvhkeremx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.qwrgou
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5712d0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5712d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qxqdgybrol
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Qylfpmj
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5712fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.r7FU34U
mov ecx, 0x5b5b90
call fcn.0050f680
push str.raaartswooq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.raidhost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.raidhost.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.random_string
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ranvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rapport
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RAR_AV
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571358
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rbfztxhn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RCSync
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rdazwlzi
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571380
mov ecx, 0x5b5b90
call fcn.0050f680
push str.reMicrosoftWindowsCurrentVersionRun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.reader_s
mov ecx, 0x5b5b90
call fcn.0050f680
push str.realkomme
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RealPlayer.exe.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5713d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.realtekc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Recycle_Bin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.recycling
mov ecx, 0x5b5b90
call fcn.0050f680
push str.reerects
mov ecx, 0x5b5b90
call fcn.0050f680
push str.refwwq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.refwwqa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.REG2RUN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Regedit32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RegistryMonitor1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RegistryName
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RegistryQuick.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RegistryWm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Registry_Key_Name
mov ecx, 0x5b5b90
call fcn.0050f680
push str.REGRUN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.regloader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RegSvr32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.reharmonis
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Relativtd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.relevantknowledge
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Relo
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5714f0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5714f4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5714fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Remote_Registry_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.remoteaccess
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Renovator
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RepGG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Reporte4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Resource
mov ecx, 0x5b5b90
call fcn.0050f680
push str.restorer32_a
mov ecx, 0x5b5b90
call fcn.0050f680
push str.restorer64_a
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ResWin2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Retsst5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.retyujik
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rewqrwerwqrewrweqrwerqr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rfmlnfoaw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rglwhox
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5715c4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RGZLTE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.richtx64.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ride1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Riivcavepny
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Riofvb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rising
mov ecx, 0x5b5b90
call fcn.0050f680
push str.riulcsxjefo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rjdvb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rmc_456ENB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rmc_5HBYBR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rmc_DH646V
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rmc_ZQGP5Y
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57164c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ro5Po4IX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RoBdb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.romahere
mov ecx, 0x5b5b90
call fcn.0050f680
push str.romahere2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.romahere3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ronouzhcdok
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rookyw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.roommaster
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rosinbrdet5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RPCInstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rqqsnd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rs32net
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rsfyibdr
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5716dc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rsystem
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5716e8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RtkAudUService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rtparjqcjdk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ruche3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ruektfaxpogkxx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ruHml
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rulletr5
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571738
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rundll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RunDll.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rundll16
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RunDll23__AVUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rundll32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rundll32_7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rundll32_8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rundll32.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.runner1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Runonce
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RunOnceUpd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.runservices
mov ecx, 0x5b5b90
call fcn.0050f680
push str.runsql
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RunSystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Runtime_Library
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RuntimeBroker
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RuntimeBroker_tdOIW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.runwin32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.runwinlogon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rustic
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rvizrano
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571840
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rwii
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rxjnqaiqybu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rxtdqmtxseg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rxyrgth
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57186c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571878
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RZTHXHelper
mov ecx, 0x5b5b90
call fcn.0050f680
push str.s2mnLex8gZ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.s425475178461263
mov ecx, 0x5b5b90
call fcn.0050f680
push str.s902998323216941
mov ecx, 0x5b5b90
call fcn.0050f680
push str.s9201
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5718c4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5718cc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sadasd657rturtjgfjhfghfghghfgh
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5718f4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5718fc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571908
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571910
mov ecx, 0x5b5b90
call fcn.0050f680
push str.salam
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SalesMonitor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Salestart
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57193c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Salus_CrashMon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SAmail
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SAMHRENDEP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SanaiFMgqU
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sankthansaftnerne
mov ecx, 0x5b5b90
call fcn.0050f680
push str.santa_svc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.satmat
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57199c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sbfiv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SBHC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sbwnkuvr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SBynyvEoHyJPuaWtc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ScamDisk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sccs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scdsgd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.schedmode
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Scheduler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Scheluder
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SCISound
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sCmdDAun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Screen_Saver_Pro_3.1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scvhchost232
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scvhchost632
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scvhchost992
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scvhchostc62600a
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scvhchov00ad
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571a98
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571aa0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scxcf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scxz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scxzca
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SD2014
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sdfghjkjhgfds
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SDR6Y_Check
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sdtltnvgmep
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sdvsad
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SearchIndexer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SearchLike
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SearchSettings
mov ecx, 0x5b5b90
call fcn.0050f680
push str.seaWDurlIE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Secure
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571b3c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Security_essentials_2010
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Security_iGuard
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Security_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571b88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Security_Protection
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SecurityCenter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SecurityService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SecurityUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SeekmoOE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SeekmoSA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Seismis6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sekun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Selection_Tools
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SENGEHES
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sentinelmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Serty
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571c3c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571c44
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Serverx
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571c54
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571c64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Service_Update_Client
mov ecx, 0x5b5b90
call fcn.0050f680
push str.servicelayer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ServiceMSDN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Services_Panel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Services32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Servicewin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.servieca.vbs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Servi
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571d04
mov ecx, 0x5b5b90
call fcn.0050f680
push str.settdebugx.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.setup
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571d28
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571d44
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571d4c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SFZDGXFH
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sgegyr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sgk7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sgobs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SGPUpdater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SharedAPPs
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571d90
mov ecx, 0x5b5b90
call fcn.0050f680
push str.shell32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.shevost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Shhejayly
mov ecx, 0x5b5b90
call fcn.0050f680
push str.shost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ShowBehind
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Showgirls.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Shrug
mov ecx, 0x5b5b90
call fcn.0050f680
push str.shshhs
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571de8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sialaden
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571e00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SIMP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Siqzuwnwtja
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571e24
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sistema_y_Nucleo_de_Windows_NT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SIVG_Agent
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571e60
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sjur
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571e70
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Skibindingens1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.skks
mov ecx, 0x5b5b90
call fcn.0050f680
push str.skls
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571e94
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SLIForceRepair
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sluffing
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sLVfmgdK
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x571ec4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SmartIndex
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SMAV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.smbu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.smss.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SMSS_System
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SMSS_User
mov ecx, 0x5b5b90
call fcn.0050f680
push str.smss32.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SMSSU
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sniffer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sntcom
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Soclexeh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SoftBrue
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SoftwareHelper
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SomanCoccygeal.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Somefox
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sony_C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sony_G
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SonyAgent
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sound_Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sound_Monitor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sound.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sound.exe_Espanha
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sound64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.soundbinary.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SonudMan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sounddrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SoundMam
mov ecx, 0x5b5b90
call fcn.0050f680
push str.soundmx
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57201c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.spa_start
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spaghettis1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spjox
mov ecx, 0x5b5b90
call fcn.0050f680
push str.splotchingcdf
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572050
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spoolsv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SPOOLSV32.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SPOOLSVV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sportscast
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572088
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572094
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpyClean
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5720a8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5720b4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5720c4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5720d4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spyware_Protection
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpywareGuard
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572104
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572114
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572128
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SQConfigChecker
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SQInstaller
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SQLoader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SQUpdatesChecker
mov ecx, 0x5b5b90
call fcn.0050f680
push str.srng
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Srv32_spool_service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.srv.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.srv_2016
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5721a4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.stak
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Star7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.startdrv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5721c4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Startup_Key
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Startup_Name
mov ecx, 0x5b5b90
call fcn.0050f680
push str.startupname
mov ecx, 0x5b5b90
call fcn.0050f680
push str.stonedrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.str_insDr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.STRAG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.strigerpom
mov ecx, 0x5b5b90
call fcn.0050f680
push str.stuo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.subcon
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572230
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sun_Java_Security_Plugin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sun_Java_Updater_v5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sun_Java_Updater_v5.1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SunJavaInstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SunJavaUp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Supposes
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SurfSideKick
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SurfSideKick_2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SurfSideKick_3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sv.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5722e4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svc_host
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SVC_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SVCBMP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svcchost.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svchos
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572320
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svchost.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svchost32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SvchostHD
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57234c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572358
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SvcManager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svcs
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57237c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svhost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svnosht.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svss
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svv_e
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Swankieta1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sweddf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.swinlog
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Swnfskt
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5723cc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sxtensionsx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sxwpcmmu
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5723ec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Admin_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Admin_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Client_Software
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Configuration_Load
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Configuration_Server
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Core_LTD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Drive_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Drive_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Fillter_Check
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_IO_Device
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Network_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Remote_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Security_Loader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Service_Resources
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_Source_Editor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Symantec_OSBoot_Security
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SymantecFilterCheck
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Synaptics_Pointing_Device_Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.syncman
mov ecx, 0x5b5b90
call fcn.0050f680
push str.syqymlwo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Syradykik
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5725e4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sys_up1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sys32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sys32_nov
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572604
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysazwbsays32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Syscmd
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572628
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysdate.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SysDiag
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572644
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SYSDLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysDrvHandler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.syseeeaz
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572670
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysgif32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysgrdadaz
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572690
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57269c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5726a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysinit
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysinter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysldtray
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Syslog
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sysmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sysmppcv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysnet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SysPnP
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572700
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SysReg
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572714
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Bust
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Configuration
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Development_Operations
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Installer_Prep
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Monitor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Presets
mov ecx, 0x5b5b90
call fcn.0050f680
push str.system_recover
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Run
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5727b4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Server_Cache
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Settings
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Soap_Pro
mov ecx, 0x5b5b90
call fcn.0050f680
push str.system_spool
mov ecx, 0x5b5b90
call fcn.0050f680
push str.system_tool
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.system_update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System.Random
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572858
mov ecx, 0x5b5b90
call fcn.0050f680
push str.system32.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sistema_Marthis
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systemdll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemCheck
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemCleaner
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemClose
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemDrive
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemDriverCheck
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5728d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Systeme.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemEmergency
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systemfiles
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemHost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systemhots32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Systemi.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemKbs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systemm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Systems
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572958
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systemsearch
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systemtask
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemTools
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systemwindows32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Systemx86
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SysTime
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systimwindow32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Systray
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SysUpd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.syswin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysWOW32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sytes
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572a00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Taarnfalkene2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tablhst
mov ecx, 0x5b5b90
call fcn.0050f680
push str.takeown
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tapicfg.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tapisys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Taram
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572a40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Task_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572a58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.taskdir
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572a74
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tava
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Taxgay
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TbgZO
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572a94
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TBPS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TClock.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tcpipmon
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572abc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572ac4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572acc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tebaduhug
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Technology_NT
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572af4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Teoridannel9
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572b10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Test11a23ert
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tetanizin5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Texasoftal5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ThunderCmp1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ThunderCmp2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tilfld
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TimeServer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572b6c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tiwc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tjuyxoqmelid
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TKRULI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TLrxdDbA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tmntsrv32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TNBPkCsf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tngwgerhy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tolv5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TOoAQcAY.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ToolBar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ToolCar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.topsadon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.topsadonagent
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572c04
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572c08
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TRANSIS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Transponder
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572c20
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Traveller
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572c34
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tregain
mov ecx, 0x5b5b90
call fcn.0050f680
push str.treta
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Trickler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TRIB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tricolo
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572c6c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.trrere
mov ecx, 0x5b5b90
call fcn.0050f680
push str.trsd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.True
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TrUk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Try2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.try6554
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tryghederne
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tsmdhwxsvyrj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tSSBpQMZcW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ttool
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ttps
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572cd8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tunectrl
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572ce8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572cf0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tvijfgehohkc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572d0c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.twhe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tyufer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572d24
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ubvuxxifgrlns
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572d40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Udsknke1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Uesxsjsntd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Uewizrlgm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ugac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UGgb9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ugtphvhf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ugueiwalf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UGZDh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.uifast
mov ecx, 0x5b5b90
call fcn.0050f680
push str.uivaua
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ujrzsryqc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.uktidukgrexc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ulmrz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UMPQUAEL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Unaspir7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.unnilquadium
mov ecx, 0x5b5b90
call fcn.0050f680
push str.unobdura
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572e08
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572e10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_Agent
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_Live_Report
mov ecx, 0x5b5b90
call fcn.0050f680
push str.update.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update123.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UpdateFirewall32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572e6c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UpdateService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UpdateSession
mov ecx, 0x5b5b90
call fcn.0050f680
push str.updatesvc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572ea0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UpdateTask
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572ebc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.updete
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UpdReg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Upgrade
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UpgradeChecker
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UpgradeHelper
mov ecx, 0x5b5b90
call fcn.0050f680
push str.upnp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.upWinsystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.URLMON
mov ecx, 0x5b5b90
call fcn.0050f680
push str.USB_Safely_Remove
mov ecx, 0x5b5b90
call fcn.0050f680
push str.USB2Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.USBcillin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.user
mov ecx, 0x5b5b90
call fcn.0050f680
push str.User_Input_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.userinfo
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x572f70
mov ecx, 0x5b5b90
call fcn.0050f680
push str.userinit
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Userpath
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UserSystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.uSjBVNE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ussi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.utilityyy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Utlzn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.utmjwlitjaich
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Utxemnt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Utycdtwu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.uwa6pcw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Uyjrvh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UZANPENU
mov ecx, 0x5b5b90
call fcn.0050f680
push str.v62J76dC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Validator
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vamsoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vaolk
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573028
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57302c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573048
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VBundleOuterDL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vceknnavarr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.veeel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VenoM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.verif_8746
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VersionRecover
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vetox
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vfgbvgbvg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vfyhbghj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ViaRegX
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5730bc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Viewer_Live
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5730d0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5730f8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573104
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573118
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573124
mov ecx, 0x5b5b90
call fcn.0050f680
push str.viti
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vjbknfzgrf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VKL_MYD1QO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VKL_TDHG8D
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573160
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vlc.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vllmzvwq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vmhost.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573184
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vnjvctedqso
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vogitq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VOPACKAGE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vpvysmb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vqdbpemci
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vsg63637
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vsjftuub
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VTXSa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vuzahqjxdr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vvgguhykaiyma
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5731fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vxdrh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vzgnuwxmjeukdfwdujqa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.W7VD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wa7pcw
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573234
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573238
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573248
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wbguxohcgabeas
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WbObzSKe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wboyuqknqhxiar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wcenter
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573284
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wDDgXZwA_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wdiwabf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wdmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WeatherOnTray
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5732b4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5732b8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5732c0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5732cc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Web_Offer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5732e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.webHancer_Survey_Companion
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Webhost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WebRebates
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WebRebates0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WebRebates1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WebSite
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wejrz6gl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wellwish1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573358
mov ecx, 0x5b5b90
call fcn.0050f680
push str.werity_32452345
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wertret
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573374
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Whinnierf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wiaitss
mov ecx, 0x5b5b90
call fcn.0050f680
push str.widowsdefender
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wifihost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wigwvr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wikhqpjb
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5733c4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5733cc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win_Audio
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win_Defender
mov ecx, 0x5b5b90
call fcn.0050f680
push str.win_init
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win_Spec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win_Nt_Sec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.win01
mov ecx, 0x5b5b90
call fcn.0050f680
push str.win10
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573420
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573428
mov ecx, 0x5b5b90
call fcn.0050f680
push str.win32app
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win32dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win32gb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win32hp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.win32Kernel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win64_Compatibility_Check
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573480
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinAntiVirusPro2006
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinAVX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winbat
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winboot
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wind32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindApp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windata
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windefend
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windefender.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinDirectories
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windirz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinDLL__service.exe_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windonw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindooiutovilwsUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Window
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Window_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowLiveMessenger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WIndown
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57357c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows.Bin.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windows1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_10_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5735c0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Audio_Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_COM_Host
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Configuration
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Data_Serivce
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Defender_Folders
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Desktop
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Driver_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Explorer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Explorer_Controler
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Firewall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Init
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Installer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5736d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Internet_Protocol
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Kernel_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Live
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Live_Messenger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Log_Agent
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Logon_Application
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Media_Center
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Media_Player
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Messenger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_msvc_Control_Host
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Networking_Monitoring
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_NT_Login_Application
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Operating_Dynamic_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Player
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573854
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Protector
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Registry_Viewer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573890
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Run
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Run_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_SA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Security_Check
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5738e8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Security_Health_Start
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Security_Server
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Service_help
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Service_Pack_Auto_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Session_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Shell_Library_Loader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_sound
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_sounds
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Start
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_System
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_System_Guard
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_TaskHost
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573a2c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Ultimate2
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573a5c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Update_Client
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_update_loader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Update_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Update_Server
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573acc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_updated
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_updates
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Utilizer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Video_Drivers
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573b40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowS32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573b5c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsAPP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsCMD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsConHost
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573b9c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsFirewalls
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsFY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsFZ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsHost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsHosts
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsMgr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windowsOffice
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573c20
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsSp2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsTimer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsUpd
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573c58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsUpdateAgent
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsUpdateCheck
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573c90
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsWOW32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsXP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinFirewallVe32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinFixer2005
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winhelp.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573ce8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinHost32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winhosts
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573d08
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wininet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wininet32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winini.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinInit
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wininit64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wininnet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winlogin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winlogioms
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winlogom.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573d7c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winlogons
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winlogoon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winlong.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winnet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winnt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winntR1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winows
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinPersistence
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winrar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinResSync
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winrun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wins
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinSecure
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573e0c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winserv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573e20
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winservices
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winservie
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinShowUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winsic
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winsnap
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winsoc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winsock32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winsrv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573e80
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinStar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winstartedt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winsys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winsys32sys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinSysModule
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinSystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinSystem32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winsysupd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinTask
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573eec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinTime
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573f00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinUltimateUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winupd32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinUpdate_Security
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winupdate.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winupdate86.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winupdater
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573f6c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinWOW64Services
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x573f88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winxp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wjtoigrji
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wjzsclsz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wkflontci
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wlzs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WMDM_PMSP_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WMedia32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WMI_Update_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wn22
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WndCfg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WNSI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.word
mov ecx, 0x5b5b90
call fcn.0050f680
push str.words
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Workfile
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Worm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WoW_Gold_Generator_Hack__By_Mana_Hacks___Updated_2012_
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574070
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wpxirkjnd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wq156dqwd16q5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wrgfpr
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5740a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wscmgr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wse_binkiland
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5740c4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wservices.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WtdedqepeLXPvCct
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wuaclt.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wuaucldt
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574108
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wupd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WUTvxOtt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wvytob
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wxcoqeshwp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wxhk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XO1XADpO01
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57414c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574174
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574178
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Xbomvdl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XCC_Start
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xcds
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xcesd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Xcpjcf
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5741b0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5741b8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5741c0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xcvbv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xfiewmuhu
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5741e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xhostl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xhostr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xhostr2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xifmvwyqevrrbn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xjrkbecbktryhg
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574220
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574224
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574228
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xlr2
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574234
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XP_64ED98D9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xp_system
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XPSP2_Firewall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Xpsynhca
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xpsystem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XqbGL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XSECVA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Xtnzjqxz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xuLlFCMm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XupiterStartup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XupiterCfgLoader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XupiterToolbarLoader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XWoMXqxn2va68jV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xxxvid
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xxxxxxxxxx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Xyalynxmlsm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xyvajfmddemlvx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XyzyGGyV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Xzornzchg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wvuNZJPyIP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.yaemu.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Yahoo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Yahoo_Messengger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.YahooStock
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ybtjh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ydsds
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ydsfchwj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ygfuyh
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5743a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.yiagbtsdnurbt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.yienjscxhqmvrb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Yjtxdgoza
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ymrpoege
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Yougmju
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Yslijsm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.yt8a
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ytzuwvgjf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Yxiahgt
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574414
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zbialdpk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ZEgbpjkZ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zhpasnkvid
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57443c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zlivaeqjz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zmgtuhjwg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ZozjABYW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zpxcst
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zqqteqyda
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zrgbtiovya
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zrjfpix
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5744a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zupdby
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zvieez
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ZxWinUpdate.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ZYMUNEeCoW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ZZChw4ZycSefR9n
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zzmmu
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7bb4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b79a4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.MAIN.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.AVG.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.WINL.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7bb4
push str._s1985
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7bb4
push str._s2309
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x574520
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov edx, dword [0x5b7654]
push edx
push str._sInfo.hta
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7bb4
push 0x574538
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7bb4
push 0x57453c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7bb4
push 0x574540
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ivmpcComSvcConfig.bat
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b78a4
push 0x57455c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x574590
push 0x5b6504
push 0x80000003
lea eax, [ebp - 0x1234]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x13c4], eax
mov ecx, dword [ebp - 0x13c4]
mov dword [ebp - 0x13c8], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x13c8]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1234]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x1230]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
call fcn.00401fca
add esp, 4
push 0x574598
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
lea edx, [ebp - 0x1230]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4b9dbb
push 0x5745b0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b78a4
push 0x5745b8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5745ec
push 0x5b6504
push 0x80000003
lea eax, [ebp - 0x1238]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x13cc], eax
mov ecx, dword [ebp - 0x13cc]
mov dword [ebp - 0x13d0], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x13d0]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1238]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x1230]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
call fcn.00401fca
add esp, 4
mov edx, dword [0x5b7650]
push edx
push str._sCCLEANER.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4b9e94
push str.ccleaner
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b78a4
push 0x574614
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x574648
push 0x5b6504
push 0x80000003
lea ecx, [ebp - 0x123c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x13d4], eax
mov edx, dword [ebp - 0x13d4]
mov dword [ebp - 0x13d8], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x13d8]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x123c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.GUPDATE.EXE__APP
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4b9f48
push str.1877SVSHOST.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4b9f57
push 0x574680
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b78a4
push 0x574690
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0xa30]
push ecx
push 0x20119
push 0
push 0x5b6504
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ba29e
mov dword [ebp - 0xa2c], 0
jmp 0x4b9fb0
mov edx, dword [ebp - 0xa2c]
add edx, 1
mov dword [ebp - 0xa2c], edx
mov dword [ebp - 0x41c], 0x400
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0x418], 0x800
mov byte [ebp - 0x1230], 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x1230]
push ecx
push 0
push 0
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0xa2c]
push ecx
mov edx, dword [ebp - 0xa30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4ba297
lea eax, [ebp - 0x1230]
push eax
call fcn.00401fca
add esp, 4
push str.LOCALMICROSOFTONEDRIVEONEDRIVE.EXE
lea ecx, [ebp - 0x1230]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba04f
push str._BACKGROUND
lea edx, [ebp - 0x1230]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba068
push str.INSTALLHOST.EXE
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba079
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSA32CHK.DLL
lea edx, [ebp - 0x1230]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ba0ab
push str.MSA64CHK.DLL
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba0bc
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TUBTUB.EXE
lea edx, [ebp - 0x1230]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba0e6
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CHLZCHLZ.EXE
lea ecx, [ebp - 0x1230]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba110
lea edx, [ebp - 0x40c]
push edx
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push str._s_rsscsrss.exe
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba15f
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CMD__C_TYPE
lea edx, [ebp - 0x1230]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba1a2
push str..TXT__CMD
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba1a2
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f680
mov edx, dword [0x5b7650]
push edx
push str._sBizum_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba1f3
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x25
push 0x25
push 0x5b7cb4
push str._s_ctmp_c_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
lea edx, [ebp - 0x1230]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba246
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7ba4
push str._s_Recycle__
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
lea ecx, [ebp - 0x1230]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba295
lea edx, [ebp - 0x40c]
push edx
mov ecx, 0x5b5b90
call fcn.0050f680
jmp 0x4ba299
jmp 0x4ba29e
jmp 0x4b9fa1
mov eax, dword [ebp - 0xa30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa30]
push ecx
push 0x20119
push 0
push 0x5747a4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ba388
mov dword [ebp - 0xa2c], 0
jmp 0x4ba2ec
mov edx, dword [ebp - 0xa2c]
add edx, 1
mov dword [ebp - 0xa2c], edx
mov dword [ebp - 0x41c], 0x400
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0x418], 0x800
mov byte [ebp - 0x1230], 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x1230]
push ecx
push 0
push 0
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0xa2c]
push ecx
mov edx, dword [ebp - 0xa30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4ba381
lea eax, [ebp - 0x1230]
push eax
call fcn.00401fca
add esp, 4
push str.POKAPOKA
lea ecx, [ebp - 0x1230]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ba37f
lea edx, [ebp - 0x40c]
push edx
mov ecx, 0x5b5b90
call fcn.0050f680
jmp 0x4ba383
jmp 0x4ba388
jmp 0x4ba2dd
mov eax, dword [ebp - 0xa30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5b84b8], 0
jmp 0x4ba3b0
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4baca1
push 0x5b8d7c
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4ba3ed
jmp 0x4ba3a1
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x40c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b78a4
push 0x5747e0
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
lea edx, [ebp - 0x1240]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x13dc], eax
mov eax, dword [ebp - 0x13dc]
mov dword [ebp - 0x13e0], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x13e0]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1240]
call sub.MFC42.DLL_CString::CString
push 0x574814
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ba4f5
mov edx, dword [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s...Run____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x57484c
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
lea eax, [ebp - 0x1244]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x13e4], eax
mov ecx, dword [ebp - 0x13e4]
mov dword [ebp - 0x13e8], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x13e8]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1244]
call sub.MFC42.DLL_CString::CString
push 0x574884
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ba5d6
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s...RunOnce____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x5748c0
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
lea ecx, [ebp - 0x1248]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x13ec], eax
mov edx, dword [ebp - 0x13ec]
mov dword [ebp - 0x13f0], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x13f0]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1248]
call sub.MFC42.DLL_CString::CString
push 0x574900
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ba6b7
mov ecx, dword [ebp - 0x414]
push ecx
lea edx, [ebp - 0x40c]
push edx
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s...Wow6432Node...Run____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
lea edx, [ebp - 0x124c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x13f4], eax
mov eax, dword [ebp - 0x13f4]
mov dword [ebp - 0x13f8], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x13f8]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x124c]
call sub.MFC42.DLL_CString::CString
push 0x57498c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ba798
mov edx, dword [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s...Wow6432Node...RunOnce____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5749d8
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
lea eax, [ebp - 0x1250]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x13fc], eax
mov ecx, dword [ebp - 0x13fc]
mov dword [ebp - 0x1400], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x1400]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1250]
call sub.MFC42.DLL_CString::CString
push 0x574a08
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ba86e
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push str.Entrada_Eliminada__HKLM...Run____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x574a3c
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
lea ecx, [ebp - 0x1254]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1404], eax
mov edx, dword [ebp - 0x1404]
mov dword [ebp - 0x1408], edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x1408]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1254]
call sub.MFC42.DLL_CString::CString
push 0x574a70
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ba944
mov ecx, dword [ebp - 0x414]
push ecx
lea edx, [ebp - 0x40c]
push edx
push str.Entrada_Eliminada__HKLM...RunOnce____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x574aa8
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
lea edx, [ebp - 0x1258]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x140c], eax
mov eax, dword [ebp - 0x140c]
mov dword [ebp - 0x1410], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1410]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1258]
call sub.MFC42.DLL_CString::CString
push 0x574ae4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4baa1a
mov edx, dword [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
push str.Entrada_Eliminada__HKLM...Wow6432Node...Run____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x574b28
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
lea eax, [ebp - 0x125c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dword [ebp - 0x1418], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x1418]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x125c]
call sub.MFC42.DLL_CString::CString
push 0x574b68
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4baaf0
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push str.Entrada_Eliminada__HKLM...Wow6432Node...RunOnce____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x574bb0
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
lea ecx, [ebp - 0x1260]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x141c], eax
mov edx, dword [ebp - 0x141c]
mov dword [ebp - 0x1420], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x1420]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1260]
call sub.MFC42.DLL_CString::CString
push 0x574be8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4babc6
mov ecx, dword [ebp - 0x414]
push ecx
lea edx, [ebp - 0x40c]
push edx
push str.Entrada_Eliminada__HKUS.Default...Run____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x574c28
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
lea edx, [ebp - 0x1264]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1424], eax
mov eax, dword [ebp - 0x1424]
mov dword [ebp - 0x1428], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1428]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1264]
call sub.MFC42.DLL_CString::CString
push 0x574c64
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bac9c
mov edx, dword [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
push str.Entrada_Eliminada__HKUS.Default...RunOnce____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
jmp 0x4ba3a1
mov ecx, 0x5b5b90
call fcn.0050f5b0
push 0x574ca8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RunOnce
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PoliciesExplorerRun
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4bacf1
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4bb086
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersion_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x574cfc
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x1268]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x142c], eax
mov ecx, dword [ebp - 0x142c]
mov dword [ebp - 0x1430], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x1430]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1268]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x574d00
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bae21
push 0x5b8d80
lea eax, [ebp - 0x414]
push eax
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4bae21
push 0x5b8d84
push 0x54
push 0x574d08
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov ecx, dword [ebp - 0x414]
push ecx
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.Entrada_Eliminada__HKLM..._s_____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersion_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x574d70
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x126c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1434], eax
mov ecx, dword [ebp - 0x1434]
mov dword [ebp - 0x1438], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x1438]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x126c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x574d74
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4baf3b
push 0x5b8d88
lea eax, [ebp - 0x414]
push eax
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4baf3b
push 0x5b8d8c
push 0x54
push 0x574d7c
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov ecx, dword [ebp - 0x414]
push ecx
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.Entrada_Eliminada__HKLM...Wow6432Node..._s_____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersion_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x574de8
push 0x5b6504
push 0x80000003
lea eax, [ebp - 0x1270]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x143c], eax
mov ecx, dword [ebp - 0x143c]
mov dword [ebp - 0x1440], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x1440]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1270]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x574dec
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bb081
push 0x5b8d90
lea eax, [ebp - 0x414]
push eax
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4bb081
push str.KIESEXTERNALFIRMWAREUPDATEKIESPDLR.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bb081
push 0x5b8d94
push 0x54
push 0x574e20
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
mov ecx, dword [ebp - 0x414]
push ecx
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s..._s_____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4bace4
mov ecx, 0x5b5b90
call fcn.0050f5b0
push 0x574e50
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574e78
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574ea0
mov ecx, 0x5b5b90
call fcn.0050f680
push str._Default_
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574ed4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4cmjc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574f04
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574f10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.addon_v57
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574f28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ADSL_DDiall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ADSL_Dia
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ADSL_Diaa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ADSL_Dial
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ADSL_Diiaal
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574f6c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574f78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AppDataLow
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Applaunch
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Audio_Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Check_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CIPA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cisvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ClipSrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Classes
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CmSTP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ComRepl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.conhost
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574fec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.csrss
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x574ffc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Darkness
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dcomcfg.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DllHst
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DriverCheck
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575054
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Esent_Utl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.exec
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575074
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575080
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FIFA10
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5750b0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.format
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FreeFly_Studio
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gbieh.1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5750e8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.harodin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.homepage.monitor.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57510c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IEudinit
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575140
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Intel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Explorer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.internetnet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.isamonitor.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.isamini.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ishost.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.issearch.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Java_RunTime_SDK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Java_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kernel32.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.keygan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Local_AppWizard_Generated_Applications
mov ecx, 0x5b5b90
call fcn.0050f680
push str.localSPM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Logitech__Inc.
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Logman
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lsass
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575234
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Macromedia_Flash_Player_Addon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.messenger
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Driver_Setup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Windows
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Windows_Update_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5752c0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5752d4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mozilla
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5752e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MqtgSVC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MstInit
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mstsc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5752fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyUserinit
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57530c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Netscape
mov ecx, 0x5b5b90
call fcn.0050f680
push str.none
mov ecx, 0x5b5b90
call fcn.0050f680
push str.notepad.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.notepad2.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NTSpool
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nvctrl.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575378
mov ecx, 0x5b5b90
call fcn.0050f680
push str.paint.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pmsngr.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Policies
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5753a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PrinterSecurityLayer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QuickTime_Task
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rare
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5753dc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5753e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rsvp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RTHDBPL
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5753f8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SafeDrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Scovc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scrnsave
mov ecx, 0x5b5b90
call fcn.0050f680
push str.services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.servises
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Setup_Windows_Media_Player
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57544c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.some
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spool
mov ecx, 0x5b5b90
call fcn.0050f680
push str.spoolsv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575468
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575470
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575478
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SysAnti
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575484
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Patcher
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57549c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemDriverLoad
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemRunOn
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5754c8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5754d0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Updates
mov ecx, 0x5b5b90
call fcn.0050f680
push str.user32.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.userini
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VB_and_VBA_Program_Settings
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57551c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575524
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VMware_hptray
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575538
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575544
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win7zip
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windows
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575558
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Internet_Explorer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Printing_Driver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Security_Tool
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winhost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winhost1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winhost2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winhost3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winhost4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wininet.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57561c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winlogon.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winmap
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinRAR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinRAR_SFX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinSecurity
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winshellwindoi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winshellwindosa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winst
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5756a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinUpdating
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5756bc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5756c0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WTools
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XAMPPGift
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5756d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.x86kernel2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xeroxw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Xpsys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xxsc5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.zsmscc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x57572c
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4bbadd
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4bbf8a
push 0x5b8d98
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4bbb1a
jmp 0x4bbace
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x40c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
lea edx, [ebp - 0x1274]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x1444]
mov dword [ebp - 0x1448], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x1448]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1274]
call sub.MFC42.DLL_CString::CString
push 0x575774
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bbc22
mov edx, dword [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s...PoliciesExplorerRun____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareWow6432NodeMicrosoftWindowsCurrentVersionPoliciesExplorerRun
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
lea eax, [ebp - 0x1278]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x144c], eax
mov ecx, dword [ebp - 0x144c]
mov dword [ebp - 0x1450], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x1450]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1278]
call sub.MFC42.DLL_CString::CString
push 0x575810
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bbd03
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s...Wow6432Node...PoliciesExplorerRun____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x57586c
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
lea ecx, [ebp - 0x127c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1454], eax
mov edx, dword [ebp - 0x1454]
mov dword [ebp - 0x1458], edx
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x1458]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x127c]
call sub.MFC42.DLL_CString::CString
push 0x5758ac
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bbdd9
mov ecx, dword [ebp - 0x414]
push ecx
lea edx, [ebp - 0x40c]
push edx
push str.Entrada_Eliminada__HKLM...PoliciesExplorerRun____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5758f4
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
lea edx, [ebp - 0x1280]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x145c], eax
mov eax, dword [ebp - 0x145c]
mov dword [ebp - 0x1460], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1460]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1280]
call sub.MFC42.DLL_CString::CString
push 0x575940
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bbeaf
mov edx, dword [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
push str.Entrada_Eliminada__HKLM...Wow6432Node...PoliciesExplorerRun____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
lea eax, [ebp - 0x1284]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1464], eax
mov ecx, dword [ebp - 0x1464]
mov dword [ebp - 0x1468], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x1468]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1284]
call sub.MFC42.DLL_CString::CString
push 0x5759e4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bbf85
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push str.Entrada_Eliminada__HKUS.Default...PoliciesExplorerRun____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
call fcn.00402ed5
add esp, 0xc
jmp 0x4bbace
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.Ci_Servs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Common_User_Interface
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Communications_Panel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Firewall_Administrating
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Info
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Explorer_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.karakirli
mov ecx, 0x5b5b90
call fcn.0050f680
push str.masterboot
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_RPC_AutoUpdater_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSCenter_update
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575af8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Service_ares
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sistema_de_Comm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svchosts
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575b30
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x575b38
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tray_SPF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_UDP_Control_Center
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zip_Manager_XP_PRO_2009
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4bc0cc
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4bc20b
push 0x5b8d9c
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4bc109
jmp 0x4bc0bd
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x40c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SoftwareMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
lea edx, [ebp - 0x1288]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x146c], eax
mov eax, dword [ebp - 0x146c]
mov dword [ebp - 0x1470], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1470]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1288]
call sub.MFC42.DLL_CString::CString
push 0x575bf4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bc206
mov edx, dword [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
push str.Entrada_Eliminada__HKLM...Terminal_Server...Run____s___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
jmp 0x4bc0bd
push str.028F96B8_C73A_4C60_B82F_3944A19B046E
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.176F706B_5175_479C_A3DF_32420F6FB01A
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.34EBA76A_E745_4B18_96C9_2B8E2BA8B246
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.38BE2BE8_EB8E_41D1_9D94_3B1697094D47
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.3A8E009B_E66D_4016_87CF_EC57FA9A4BC1
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.4D4D0357_0376_4656_A040_65AC089E84A2
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.51F7DE65_A990_4213_BDB9_C2657FA7F3F4
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.533403E2_6E21_4615_9E28_43F4E97E977B
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.53C267B2_B01D_410F_A4DD_A32962EE55F4
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.6D5AF218_5F7E_40E0_B49D_54FFAFE2001A
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.879F721E_7F23_4B7F_B65B_F5A8F518864A
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.8804A543_42D3_4D71_9685_B0243D5526F3
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.89E46EA6_2F87_4D79_8FFA_8B264F93F54A
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.9ECCDEFC_1C26_4BB3_B6DF_252672D9FFFA
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.A0F322D5_6A13_4CAB_84CF_FABB5690618E
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.AC3E336C_B524_47F0_9AA2_5F67AA056086
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.B9EE49F9_62A3_408D_858F_4ED9A23BAA24
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.BF6D8439_BAC1_4E73_94FE_9910D098AE00
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.C68E9BB6_3DBD_4C4B_910B_C5D84A7EBB03
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.D4F14684_336F_44FC_8D9E_8A73DAE003EC
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.F18F212B_E13B_425E_B67A_BDFAA4DC2515
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.F1BC674D_15D8_46C5_AC51_12AB16D67616
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.F28C2F70_47DE_4EA5_8F6D_7D1476CD1EF5
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.F577A1BA_D82D_4BB2_8430_B767285D081D
mov ecx, 0x5b5ba8
call fcn.0050f680
push str.F811C371_1DC7_4E2F_8676_D96B85BE4AF1
mov ecx, 0x5b5ba8
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4bc39b
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5ba8
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4bd86f
push 0x5b8da0
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4bc3d8
jmp 0x4bc38e
push str.CFBFAE00_17A6_11D0_99CB_00C04FD64497
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4bc3ff
jmp 0x4bc38e
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x1230]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerToolbar
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x576178
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x57617c
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5761ac
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5761b0
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x1230]
push eax
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5761ec
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerToolbarWebBrowser
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x57622c
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerToolbarWebBrowser
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x576268
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerToolbarWebBrowser
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x1230]
push eax
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5762b0
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerToolbarShellBrowser
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5762f4
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerToolbarShellBrowser
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x576334
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerToolbarShellBrowser
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x1230]
push eax
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x576380
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerExplorer_Bars_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x57643c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
lea eax, [ebp - 0x1230]
push eax
push str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea ecx, [ebp - 0x1230]
push ecx
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerURLSearchHooks
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea eax, [ebp - 0x1230]
push eax
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea ecx, [ebp - 0x1230]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea eax, [ebp - 0x1230]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea ecx, [ebp - 0x1230]
push ecx
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExtPreApproved_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExtPreApproved_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExtPreApproved_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExtSettings_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExtStats_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExtStats_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExtCLSID
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionPoliciesExtCLSID
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftInternet_ExplorerActiveX_Compatibility_
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576940
push 0x44
push 0x576948
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x57695c
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576964
push 0x5b6504
push 0x80000000
lea edx, [ebp - 0x128c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1474], eax
mov eax, dword [ebp - 0x1474]
mov dword [ebp - 0x1478], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x1478]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x128c]
call sub.MFC42.DLL_CString::CString
push 0x576968
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4bd227
push 0x576970
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576978
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576980
push 0x5b6504
push 0x80000000
lea eax, [ebp - 0x1290]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x147c], eax
mov ecx, dword [ebp - 0x147c]
mov dword [ebp - 0x1480], ecx
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x1480]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1290]
call sub.MFC42.DLL_CString::CString
push 0x576984
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bce7f
push 0x5b8da4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4bce7f
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x57698c
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576994
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5769b0
push 0x5b6504
push 0x80000000
lea ecx, [ebp - 0x1294]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1484], eax
mov edx, dword [ebp - 0x1484]
mov dword [ebp - 0x1488], edx
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x1488]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1294]
call sub.MFC42.DLL_CString::CString
push 0x5769b4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bcf83
push 0x5b8da8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4bcf83
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5769bc
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5769c4
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5769d0
push 0x5b6504
push 0x80000000
lea edx, [ebp - 0x1298]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x148c], eax
mov eax, dword [ebp - 0x148c]
mov dword [ebp - 0x1490], eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x1490]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1298]
call sub.MFC42.DLL_CString::CString
push 0x5769d4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bd09a
push 0x5b8dac
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4bd09a
push 0x5769dc
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.CLSID_sInprocServer32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x576a00
push 0x5b6504
push 0x80000000
lea ecx, [ebp - 0x129c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1494], eax
mov edx, dword [ebp - 0x1494]
mov dword [ebp - 0x1498], edx
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x1498]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x129c]
call sub.MFC42.DLL_CString::CString
push 0x576a04
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4bd1af
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.CLSID_sLocalServer32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x576a24
push 0x5b6504
push 0x80000000
lea eax, [ebp - 0x12a0]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x149c], eax
mov ecx, dword [ebp - 0x149c]
mov dword [ebp - 0x14a0], ecx
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x14a0]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12a0]
call sub.MFC42.DLL_CString::CString
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.CLSID_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4bd227
mov edx, dword [ebp - 0x414]
push edx
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.Eliminada_Class____s______s_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x576a54
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576a68
push 0x5b6504
push 0x80000000
lea eax, [ebp - 0x12a4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14a4], eax
mov ecx, dword [ebp - 0x14a4]
mov dword [ebp - 0x14a8], ecx
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0x14a8]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12a4]
call sub.MFC42.DLL_CString::CString
push 0x576a6c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4bd783
push 0x576a74
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push str.ProgID
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576a90
push 0x5b6504
push 0x80000000
lea ecx, [ebp - 0x12a8]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14ac], eax
mov edx, dword [ebp - 0x14ac]
mov dword [ebp - 0x14b0], edx
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x14b0]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12a8]
call sub.MFC42.DLL_CString::CString
push 0x576a94
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bd3d9
push 0x5b8db0
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4bd3d9
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x576a9c
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push str.VersionIndependentProgID
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576acc
push 0x5b6504
push 0x80000000
lea edx, [ebp - 0x12ac]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14b4], eax
mov eax, dword [ebp - 0x14b4]
mov dword [ebp - 0x14b8], eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x14b8]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12ac]
call sub.MFC42.DLL_CString::CString
push 0x576ad0
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bd4de
push 0x5b8db4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4bd4de
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.Wow6432NodeCLSID_
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push str.TypeLib
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x576af8
push 0x5b6504
push 0x80000000
lea eax, [ebp - 0x12b0]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14bc], eax
mov ecx, dword [ebp - 0x14bc]
mov dword [ebp - 0x14c0], ecx
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x14c0]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12b0]
call sub.MFC42.DLL_CString::CString
push 0x576afc
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4bd5f5
push 0x5b8db8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4bd5f5
push str.TypeLib_
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.Wow6432NodeCLSID_sInprocServer32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x576b34
push 0x5b6504
push 0x80000000
lea edx, [ebp - 0x12b4]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14c4], eax
mov eax, dword [ebp - 0x14c4]
mov dword [ebp - 0x14c8], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x14c8]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12b4]
call sub.MFC42.DLL_CString::CString
push 0x576b38
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4bd709
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.Wow6432NodeCLSID_sLocalServer32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x576b64
push 0x5b6504
push 0x80000000
lea ecx, [ebp - 0x12b8]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14cc], eax
mov edx, dword [ebp - 0x14cc]
mov dword [ebp - 0x14d0], edx
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x14d0]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12b8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.Wow6432NodeCLSID_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4bd783
mov eax, dword [ebp - 0x414]
push eax
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.Eliminada_Class__x86_____s______s_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5b78a4
push str._sSoftwareClassesCLSID_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.SoftwareClassesCLSID_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareClassesWow6432NodeCLSID_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5ba8
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SoftwareWow6432NodeClassesCLSID_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
jmp 0x4bc38e
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.smartdownloader.JSHelper
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4bd8a3
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4bd940
push 0x5b8dbc
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4bd8df
jmp 0x4bd894
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x576c4c
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
jmp 0x4bd894
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str..___
mov ecx, 0x5b5b90
call fcn.0050f680
push str..8a0b51a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str..9e1bbe88
mov ecx, 0x5b5b90
call fcn.0050f680
push str..ab2da064
mov ecx, 0x5b5b90
call fcn.0050f680
push str..b3dini
mov ecx, 0x5b5b90
call fcn.0050f680
push str..basta
mov ecx, 0x5b5b90
call fcn.0050f680
push str..Black
mov ecx, 0x5b5b90
call fcn.0050f680
push str..bwp
mov ecx, 0x5b5b90
call fcn.0050f680
push str..crypted
mov ecx, 0x5b5b90
call fcn.0050f680
push str..fsharproj
mov ecx, 0x5b5b90
call fcn.0050f680
push str..iad
mov ecx, 0x5b5b90
call fcn.0050f680
push str..key
mov ecx, 0x5b5b90
call fcn.0050f680
push str..lockbit
mov ecx, 0x5b5b90
call fcn.0050f680
push str..Loki
mov ecx, 0x5b5b90
call fcn.0050f680
push str..mpf
mov ecx, 0x5b5b90
call fcn.0050f680
push str..roxrox
mov ecx, 0x5b5b90
call fcn.0050f680
push str..sage
mov ecx, 0x5b5b90
call fcn.0050f680
push str..stn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.____auto_file
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8a0b51a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9e1bbe88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ab2da064
mov ecx, 0x5b5b90
call fcn.0050f680
push str.b3d_auto_file
mov ecx, 0x5b5b90
call fcn.0050f680
push str.b3dini_auto_file
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Black
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bvtcogqv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bwpfile
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Crypted
mov ecx, 0x5b5b90
call fcn.0050f680
push str.csfile
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dtdp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iadfile
mov ecx, 0x5b5b90
call fcn.0050f680
push str.icoo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.idid
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x576d9c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mprf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.My345.Application
mov ecx, 0x5b5b90
call fcn.0050f680
push str.roxrox_auto_file
mov ecx, 0x5b5b90
call fcn.0050f680
push str.s3d_auto_file
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sage.notice
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Satan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.secfile
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sezfile
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x576e08
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Applications_autos.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Applications_bingo.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Applicationsdvd.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ApplicationsOfferBox.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ApplicationsProceso_inactivo_del_sistema.com
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Applicationsusa.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Applications_sysdrv.exe
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4bdc53
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4bdcc8
push 0x5b8dc0
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4bdc8b
jmp 0x4bdc44
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
jmp 0x4bdc44
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.0DC5CD7C_F653_4417_AA43_D457BE3A9622
mov ecx, 0x5b5b90
call fcn.0050f680
push str.03F8822F_8877_4002_8BCD_B532D53D8471
mov ecx, 0x5b5b90
call fcn.0050f680
push str.055069F3_F78B_4BD1_A277_FE66648D3300
mov ecx, 0x5b5b90
call fcn.0050f680
push str.09C554C3_109B_483C_A06B_F14172F1A947
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0F95E1D1_07F3_4f21_8E14_579800AF8CEE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.13FACA62_5FC4_4817_9175_9C8D00975916
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1C02CE6B_CC12_4EA1_B2D8_113F611F25C2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1FAEE6D5_34F4_42AA_8025_3FD8F3EC4634
mov ecx, 0x5b5b90
call fcn.0050f680
push str.367A86A5_D048_4785_86BE_4E2706AAFDD9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38061EDC_40BB_4618_A8DA_E56353347E6D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38495740_0035_4471_851E_F5BBB86AB085
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38A066B0_DD5F_4226_AC4F_6A27C1BFB892
mov ecx, 0x5b5b90
call fcn.0050f680
push str.39CB8175_E224_4446_8746_00566302DF8D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3B99F202_145A_4E5A_AC7B_88A36910BF5E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.418B46A9_5343_4E1A_A654_42B04E3F869E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.465DACD9_7035_4824_AE3E_F883EBE97261
mov ecx, 0x5b5b90
call fcn.0050f680
push str.47EFD4AD_CB46_4549_B24B_CEE415394C56
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4A3D609A_43B8_4406_B793_84F244246325
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4E1E9D45_8BF9_4139_915C_9F83CC3D5921
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4F5E5D72_C915_4F3B_908B_527D064B0FAA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.51120B18_96E6_46DA_90EB_4E4B9F32B1CF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.54AC0313_C709_4F55_A430_EC7E89F74665
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5846D519_70D1_494A_BFBB_139AA8104AFF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5CD19420_B328_47D5_A55F_1C07638EFDF8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.612AC02F_E650_4482_AC9A_E1F23BA12003
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67EE7798_F2A0_415C_9473_0F174BD5A8B8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.681147C4_D615_461A_960F_655871E315C3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6E0AFB50_AB22_477C_B16A_AA155937791C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.70F17C8C_1744_41B6_9D07_575DB448DCC5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.710BCB5B_8C6C_483E_A4F5_FAF083B13184
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7169BBB3_3289_4696_B35D_4A88BCF6FB12
mov ecx, 0x5b5b90
call fcn.0050f680
push str.73364D99_1240_4DFF_B11A_67E448373048
mov ecx, 0x5b5b90
call fcn.0050f680
push str.76044441_36EA_4E99_A71A_C12070DD13CD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7656BFE4_2AAE_4E04_98B6_5912E99FBE38
mov ecx, 0x5b5b90
call fcn.0050f680
push str.77A7D7AB_576A_4B90_B4EE_909093C3BC69
mov ecx, 0x5b5b90
call fcn.0050f680
push str.78364D99_A640_4ddf_B91A_67EFF8373045
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7911272A_A32A_404E_8A51_EE18B99B18C4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7B6A2552_E65B_4a9e_ADD4_C45577FFD8FD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7E8A36EA_2501_4ED3_A3C8_CFA9143FB169
mov ecx, 0x5b5b90
call fcn.0050f680
push str.80FABB17_63AF_4655_9F07_B6509EE37AF2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.835315FC_1BF6_4CA9_80CD_F6C158D40692
mov ecx, 0x5b5b90
call fcn.0050f680
push str.860CF2C6_730C_4D98_B6E9_B826F3FC972D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8A1E94DA_725D_4F64_B110_DB3F73ADB6F7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8B1E7CDB_DAFA_484d_A7DA_A1D5E7333DA4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8D71EEB8_A1A7_4733_8FA2_1CAC015C967D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.90A52F00_64AC_4DC6_9D7D_4516670275D0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.91C9CE76_9EB1_4A77_92A1_27C44DBBFEEE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9340F2B2_4F27_4575_8BAE_4AAD70B69B28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9393E528_CEA7_42BC_B5B8_BA37D6E3B9EF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.951B3138_AE8E_4676_A05A_250A5F111631
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9B0CB95C_933A_4B8C_B6D4_EDCD19A43874
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9DA1990B_9BCA_4c80_AEFB_11A40FA849F9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AC3F36D4_F905_4FE9_A926_EB937E66F591
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AFBB7970_789A_4264_BA70_E8127DECE400
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B12E99ED_69BD_437C_86BE_C862B9E5444D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C26644C4_2A12_4CA6_8F2E_0EDE6CF018F3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C628512D_A058_4BD4_B47B_B036F45FA02B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CCEBBEB5_D011_41B5_9F92_01F88A38DC0D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D2083641_E57F_4EAB_BB85_0582424F4A29
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D28CD14C_50BE_4CFA_951E_B37F25DA3472
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D616A4A2_7B38_4DBC_9093_6FE7A4A21B17
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D7EE8177_D51E_4F89_92B6_83EA2EC40800
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D8C0508C_E235_4D9E_A27E_C8BB5F527DC9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D988AD99_A33F_49bb_9D88_685B1EDC908F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DEE5D795_A276_43B5_A04A_511149A354F0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CFDAFE39_20CE_451D_BD45_A37452F39CF0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E74EF90A_476E_4B2B_9431_07FCAB5158D6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E7E155EE_EEF2_46AF_99B7_65F1269DC3CF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EE10A303_0C60_4ACb_A033_95A790FA4DCD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F02B8C83_C817_4EA2_A499_29257DA0373A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F1F040D5_E8F8_4680_B101_9334E9773841
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F4406238_983A_4845_9053_F1D0007FD135
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F48FC5B2_094A_44C7_B48C_289738C9582D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F6BDB4E5_D6AA_4D1F_8B67_BCB0F2246E21
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3045035B_3C14_4698_8AC4_ADB18CC42C1E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ActiveX.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ad_protect.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AMNotifier.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BHO.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bho_adw.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BookedSpace.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CheckProduct2_1.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CodecBHO.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.compclr.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.crutch
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CryptoXML.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DailyToolbar.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DealPlyLive.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DefaultTabBHO.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dll.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EoEngineBHO.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.escort.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.escortApp.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.escortEng.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.escorTlbr.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.esrv.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FFWrapr.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FxCore.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GenericAskToolbar.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HungryHands.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.icoou.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.icooue.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IeBHOs.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IEObject.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LPVideo.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MalwareWipe.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MenuButtonIE.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MessengerUpdateProject.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MMFxCtrl.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MPAgent.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mscfg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mscfg.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MTWB3SH.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.My404.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyBHOImpl.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NaviHelper.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NHelper.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.npB5TPlugin.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.oesrv.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.priam_bho.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PriceGongIE.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PriceGong2IE.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PricePeep.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pxwma.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rfsearchhandler.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Saristar.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sidebar.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SliderShow.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sostatatl.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.spamdet.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpyAxe.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpywareStrike.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Toolbar.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tutoriales100BHO.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VirtualDNS.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wajam.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WebCakeIEClient.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.webinst.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinPGI.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WStart.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XPlugin.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.YontooIEClient.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.yndbar.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ZangoToolbar.DLL
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4be55d
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4be5d3
push 0x5b8dc4
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4be595
jmp 0x4be54e
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.AppID_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
jmp 0x4be54e
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.00000000_A447_4EB9_A8D8_0C4B0661D988
mov ecx, 0x5b5b90
call fcn.0050f680
push str.006C2F9B_122D_438F_BAC0_DE3C620D2EC6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.00B92D92_8B7D_4A19_A3F1_43113B4DBCAF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.00BDA9FC_5732_4BE5_BDE8_C2E1F8013386
mov ecx, 0x5b5b90
call fcn.0050f680
push str.00BE85E6_E80A_45DA_96C6_7B3356EDF3D8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.00D38C81_14B3_44DE_B023_3BDC5BDE4FEC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.010653E4_75EC_4D9B_AE49_F64FC810770D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.014DA6C4_189F_421A_88CD_07CFE51CFF10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.014DA6C6_189F_421A_88CD_07CFE51CFF10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.014DA6CA_189F_421A_88CD_07CFE51CFF10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.014DA6CC_189F_421A_88CD_07CFE51CFF10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.01C78433_6FDF_4E5A_A82D_B535C32E03DF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0215DC7A_EF2F_451C_9392_B6481B2A4DAB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.02522575_D17D_43E9_940D_B3C6D281C6DD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.03232254_8920_4061_A381_B5304E8A7D1D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.038E3866_3FE9_4846_8EC1_37AB8AAB8DEA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.03B800F9_2536_4441_8CDA_2A3E6D15B4F8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0494D0D4_F8E0_41AD_92A3_14154ECE70AC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0494D0D6_F8E0_41AD_92A3_14154ECE70AC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0494D0DA_F8E0_41AD_92A3_14154ECE70AC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0494D0DC_F8E0_41AD_92A3_14154ECE70AC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.04C490EA_75B3_44B2_8F1E_BA7E810C755B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.04D79E9F_09A9_4AED_9FC2_6E63A3BCA51E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.05080E6B_A88A_4CFD_8C3D_9B2557670B6E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.06170642_FA65_4FB6_AC79_5F235CB99BC2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.06E03CD7_E717_4882_A418_CC7797A5C5F1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.06E48DEC_C2F2_4245_A3FC_1A1A2EA20DB2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0749862D_FF01_42A9_A90B_39A079DCA0C1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.076BCC99_11F1_422A_84C9_18CDECAED8BB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.07B18EAA_A523_4961_B6BB_170DE4475CCA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.07B18EAC_A523_4961_B6BB_170DE4475CCA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.07F0A542_47BA_11D4_8A6D_0050DA2EE1BE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.07F0A544_47BA_11D4_8A6D_0050DA2EE1BE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.087EEE04_197D_470D_9660_FDF5AA32CA3A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.089A95BD_B9C4_4D05_97E8_D87566F631A8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.08AA0598_6A23_4364_9BF4_6D5F57F42993
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0923E315_2D8B_48CE_A37C_AE9A42F9711C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0985C112_2562_46F2_8DA6_92648BA4630F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.09CEE5C3_CEB5_4E4B_9885_A0BAD4305D9A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0A089E22_5736_4092_B3F8_3F0D5F345482
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0AD3AB16_6D0E_4F04_8660_FB1F36BC2DC0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0AFD55C8_ADF8_4A33_A6E1_DEDB7A36AEB4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B080004_7CE5_447B_A9E8_B9E2CDBE2D8E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B0A76E7_ADE1_41F4_B157_559605721B3A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B32BCCD_4D64_48EB_8EC3_9BA0807D1349
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B4D9E17_97C3_4BB5_9026_3E9CD991481B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B595E3D_27BE_4DA1_A278_CA4D904B5823
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B6EF17E_18E5_4449_86EA_64C82D596EAE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B9A27EB_125F_4F3E_A35C_2769C47A1442
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0BBB0424_E98E_4405_9A94_481854765C80
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0BBBE69A_767B_475B_829B_1589B86AE9FA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0C22DE22_85B0_48F2_8D95_28E2AD2B713F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0C6E0440_0B50_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0CFC2012_205B_4E00_9417_35822237C52C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0D146B7F_FA35_465D_B716_BCBC1F9A92D3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0D17D945_4EB1_4370_B3B0_E566D5014B0A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0D1F7C84_8123_11D0_B5CA_0000B43698D6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0D1F7C83_8123_11D0_B5CA_0000B43698D6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0D5CC8AE_0BB0_49C3_BA33_BA4508EA43CC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0D721150_AEF3_457B_B03A_5097B623CE45
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0F2A4ADC_DABF_4980_8DB4_19F67D7B1F95
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0F3332B5_BC98_48AF_9FAC_05FEC94EBE73
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0F4FE440_983F_11D0_9B9C_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0F7471BA_905C_43D6_A66D_5C97408BCDE2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0FBC3EFB_FC98_4B32_BF10_BDE9AA4DEA5A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0FD6420A_F789_40AE_B921_3983F84E074E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1037B06C_84B7_4240_8D80_485810A0497D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1081D532_7DE4_40BD_B912_388FA6B27C78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1093995A_BA37_41D2_836E_091067C4AD17
mov ecx, 0x5b5b90
call fcn.0050f680
push str.10DE7085_6A1E_4D41_A7BF_9AF93E351401
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1150F4C7_7396_4CEA_B963_07FA0F62344C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.120927BF_1700_43BC_810F_FAB92549B390
mov ecx, 0x5b5b90
call fcn.0050f680
push str.121F82D9_7404_4D41_9E97_E1009DA0B64E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1230CF51_6BC4_4A23_B3F1_C7CF0AFED619
mov ecx, 0x5b5b90
call fcn.0050f680
push str.124051BD_57BA_4614_945E_798AC91581B4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12473FC3_61A7_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12473FC4_61A7_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12473FC5_61A7_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12473FC7_61A7_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12813770_461E_4A9F_8C5B_C227A8E9FBE8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12ED388E_2A02_FC3B_789F_0805D7B09F0B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.13A01221_84D3_460B_AB52_2ED0720760A0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.13E3FF74_B861_4E69_B223_43D711686832
mov ecx, 0x5b5b90
call fcn.0050f680
push str.13F90346_AD79_4A9F_9B57_0234675670D6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.143DDDDC_B873_459D_B3D8_7A708B278278
mov ecx, 0x5b5b90
call fcn.0050f680
push str.14A9DA84_0C80_4520_8452_F5C7C911A003
mov ecx, 0x5b5b90
call fcn.0050f680
push str.14D1A72C_8705_11D8_B120_0040F46CB696
mov ecx, 0x5b5b90
call fcn.0050f680
push str.15030BC0_0B52_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1562D24E_F5BF_4BB4_AF4C_BBB610B62638
mov ecx, 0x5b5b90
call fcn.0050f680
push str.15B6BAC9_774E_4A08_B9A7_323860C8F96E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.15CD9136_9972_406F_9BA8_DA0F542B5EA3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.16097036_894C_4C00_A61F_93CA0D49A70E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.165E8C46_D58D_4A82_8A8B_5A16237715D4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.16B17BD2_6E3C_40C3_AF19_D314DB77DA7A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.16C65D96_EF19_4439_A6EA_F73A8BEC4DF0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.16F6A635_09F8_44E6_953E_81D037647255
mov ecx, 0x5b5b90
call fcn.0050f680
push str.175816A5_219E_4079_B2F9_53C501C409BA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.17A45F93_AEC8_440B_AC33_1BA9CC3192AC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.17DE5E5E_BFE3_4E83_8E1F_8755795359EC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1823BC4B_A253_4767_9CFC_9ACA62A6B136
mov ecx, 0x5b5b90
call fcn.0050f680
push str.18BE3F04_C12F_4AC4_A275_7CE79F3FF4F2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.19814312_B543_47A6_9E7A_DA9DF1A977B3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.19DFB2CA_9B27_11D4_B192_0050DAB79376
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1A1496C8_597D_4944_B06A_8320A52C9FC5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1A1BBE49_C6F1_40EA_9D2F_262F0AF6DDE3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1A8B567B_BD3F_44A1_8B94_F50D37A1914E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1AAEC831_BE08_4FE4_9743_B435BA70DF61
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1ABD6DAC_9E20_4E9E_A13F_8879E08C30BC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1AD27395_1659_4DFF_A319_2CFA243861A5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1B3843C0_3C67_418C_B795_0E6D07DE7A77
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1B470E19_1C84_3D77_B57E_6872A8571D2D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1B540D44_3F61_4394_AE30_25FDC3649405
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1B97A696_5576_43AC_A73B_E1D2C78F21E8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1BEF63E3_773F_4DEE_8BC2_3AB8A1C7AECD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1C01D150_91A4_4DE0_9BF8_A35D1BDF1001
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1C1793E0_1034_4CAC_837D_AA545F6961BF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1C888195_0160_4883_91B7_294C0CE2F277
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1D1E9B3D_5A4C_4C70_A9B4_5A19E0C625DC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1D2CC793_B043_4DD2_A52C_3D9ADE61BBBD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1D4DB7D1_6EC9_47A3_BD87_1E41684E07BB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1D4DB7D3_6EC9_47A3_BD87_1E41684E07BB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1D91D9E0_004B_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1DE9EE01_DF51_49DB_9BDD_5990B35C1C2A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1E1B2878_88FF_11D2_8D96_D7ACAC95951F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1E1B2878_88FF_11D3_8D96_D7ACAC95951A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1E89B621_A273_4318_88D3_BA90C271A29A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1E98666F_6260_42C9_B846_32B20FDEFE7B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1EB48AA7_D3FE_4E4C_AC8E_B01594496AC0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1F323594_30E9_4E1E_8262_CA7B4D0A65A1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1F52A5FA_A705_4415_B975_88503B291728
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1F63B171_E2F3_4362_A484_8563144D62E6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1F8EDE97_36D5_422A_B8F0_9406E2D87C60
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1F934AB2_3FEA_454B_BA77_FCD0EDC64820
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1FA6A0F9_705D_4C47_B67C_F12D5F171470
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2022154E_7E3E_4809_871E_1B45A6FC7058
mov ecx, 0x5b5b90
call fcn.0050f680
push str.20C9D84F_244D_10E1_B3C1_20805E499D95
mov ecx, 0x5b5b90
call fcn.0050f680
push str.20F13844_04BC_4987_9964_2502F0DA54D3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.20F36AF3_3486_4BB6_8BCB_F1F8ABE74D07
mov ecx, 0x5b5b90
call fcn.0050f680
push str.214345B8_BB69_498D_A168_29F58F15D806
mov ecx, 0x5b5b90
call fcn.0050f680
push str.214BD380_BE0C_4157_B235_E26296D11B48
mov ecx, 0x5b5b90
call fcn.0050f680
push str.220959EA_B54C_4201_8DF2_1CFAC8B59FD7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.224302B0_94E9_45C2_9E5B_BA989EE556E1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.232731D0_2B12_4E36_8BBB_010CF1AE318E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.234F09FB_FE89_4C6D_9203_31832FC051C3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.238C32AC_955D_4707_AAB9_C9B3AB8D4225
mov ecx, 0x5b5b90
call fcn.0050f680
push str.23F43240_F78D_11D0_9A50_00AA004812C2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.23FD014C_455B_4497_98E9_D66EE36F1DE6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.241667A3_EC83_4885_84DD_C2DAAFC1C5EA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.247A115F_06C2_4FB3_967D_2D62D3CF4F0A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.254EC5E9_9BD6_4CFD_917B_053AD6F4918A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.25630B50_53C6_4E66_A945_9D7B6B2171FF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.258A3625_183B_4477_AEE2_EA54DF6D878D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2631681A_7A3A_463C_8FEA_5F69227D11D5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.27BC6871_4D5A_11D4_8A6D_0050DA2EE1BE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.27C4569F_8728_4958_A920_A607CAE8153C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2805A558_1E98_48FB_8BA5_49A3AD78B129
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28816466_D79F_4C00_9A53_B5E951618146
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28E6CCE2_3F2C_4B3D_9CB4_2FC8715A3ECE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.292ECB89_350E_45D2_816F_52C15305B144
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2A1647E8_3EC2_49FE_B632_E12D765FA0CC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2A34546C_C437_460A_88AF_D4703A548EA9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2A5C5DAE_63B0_46C3_BAC8_BA46080843B8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2B0F7132_11FC_4262_A1D7_623908D6EF6A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2BB15D36_43BE_4743_A3A0_3308F4B1A610
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2BDBDE40_A3A5_4888_8569_656AE250326C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2D0F5208_3198_49A4_86A7_D65E9E582751
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2DC9D84F_144D_11E1_B3C9_10805E499D95
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2DD8D482_8F1C_4180_AA8E_9D5819E5F2EA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2DE07D90_DC04_11D0_A875_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2DECFCC9_D910_4BAC_94B8_FC006827A60F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2E3537FC_CF2F_4F56_AF54_5A6A3DD375CC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2E623B96_B166_4C70_8169_820761794299
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2E9937FC_CF2F_4F56_AF54_5A6A3DD375CC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2ED5AF98_9258_45BA_B79B_06625C92F662
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2F099AF0_6329_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2F523082_5A0B_11D0_9B9C_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2F685B36_C53A_4653_9231_1DAE5736DE45
mov ecx, 0x5b5b90
call fcn.0050f680
push str.30104E21_FF0B_484C_A6CD_B2735A0D7DCE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3045CF3C_B5CC_4E9C_9C77_95FF72ABE2E5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.30B15818_E110_4527_9C05_46ACE5A3460D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.31321312_E1BB_49AB_80EB_13212CA78746
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3177B0AA_7C67_46B4_BA02_574D7E368D4F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.31885040_9240_429D_8923_77D1C11612A9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.31CA5C07_7F5F_4502_8C77_99A91558ADD0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.31D5A430_3808_4B95_A412_60C9A9F3EC07
mov ecx, 0x5b5b90
call fcn.0050f680
push str.323D7F70_D298_3CB8_B6DA_A0033269F3ED
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3256C64D_ECB2_421C_AE34_A4C6118FF4EA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.32A08E44_2A9E_4F80_A770_19B4335C2D56
mov ecx, 0x5b5b90
call fcn.0050f680
push str.32E715F3_6481_4118_A689_504312933CE6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.339D8AFF_0B42_4260_AD82_78CE605A9543
mov ecx, 0x5b5b90
call fcn.0050f680
push str.33D1E307_8C13_4ACF_A07B_E0D163825619
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3408AC0D_510E_4808_8F7B_6B70B1F88534
mov ecx, 0x5b5b90
call fcn.0050f680
push str.340D8791_0E2C_43CF_9671_7E90AAFBF0DA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.34A117AD_7F43_4859_BF97_ADC46488953F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.34DAE02F_AAC8_4A32_A188_7444BCDAE162
mov ecx, 0x5b5b90
call fcn.0050f680
push str.34DCDBDB_60EF_4281_92C6_68C299AAB8E5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.34F4D917_31E4_464C_B8B3_84C1CE76B395
mov ecx, 0x5b5b90
call fcn.0050f680
push str.34FC73F9_9499_4B85_8E27_F13148E8E2E1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.350CF545_DD5A_4807_B02A_FA1B41339B29
mov ecx, 0x5b5b90
call fcn.0050f680
push str.35B576B9_5A0F_43D7_8174_2AC714DC3AD2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.365B9A54_E613_46E5_9DB1_4F91A9DE80BD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3667E7B0_4F28_11D1_8ADB_00609761C47A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.36CC2180_B6BF_4951_9578_6B0C40044AAA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.37029DE8_6378_45E3_AE58_D2C4A416AEB0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.370F6353_41C4_4FA6_A2DF_1BA57EE0FBB9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3786A03B_108D_48F4_B09C_60262531E895
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3794345D_C731_4FBB_8471_73DDC8DFFDD2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.37B85A2A_692B_4205_9CAD_2626E4993404
mov ecx, 0x5b5b90
call fcn.0050f680
push str.37B85A2C_692B_4205_9CAD_2626E4993404
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38252777_2500_456E_8B3D_A55850306DA2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38370864_346F_4AFA_8C4B_4FBFF518C0BB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38493F7F_2922_4C6C_9A9A_8DA2C940D0EE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.385AB8C4_FB22_4D17_8834_064E2BA0A6F0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3872760B_D0D8_41E0_9A73_E6A40E30D5AC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38EF2B7F_E291_4101_8553_E1B7C4A0C3F6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.38EF87CE_78A1_11D6_918E_00E02964E8E3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3A021D2F_5F75_47F5_9BAB_A137E1FB015F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3B3F3AAD_FB97_49FF_BFEE_D22869AC4326
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3B703950_6699_4FFC_BDC1_1CD0CB6A9F5E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3D7247F1_5DB8_11D4_8A72_0050DA2EE1BE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3D782BB2_F2A5_11D3_BF4C_000000000000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3D7FDFC0_2192_4150_B573_DEE0661876C3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3D9816C8_437F_4859_A307_849F0A738F28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3D9FD47C_E0B5_4005_9ADE_552980D3761F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3DBDA661_F6D1_4A43_8EAA_9A95977257F1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E1656ED_F60E_4597_B6AA_B6A58E171495
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E43040C_73C1_4898_A4F8_E2C9428B1167
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E4BCF50_865B_4EF4_A0BC_BF57229EA525
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E53E2CB_86DB_4A4A_8BD9_FFEB7A64DF82
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E589169_86AD_44FE_B426_F0BF105D5582
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E5B0894_FE91_4063_BB41_D885C7691581
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E60160F_0ED6_4DCC_B6B6_850CDE4FD217
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E720451_B472_4954_B7AA_33069EB53906
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E720453_B472_4954_B7AA_33069EB53906
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3E8EBBAC_9AAA_4ED5_9875_55C13594ABE3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3F04CBF7_CD62_4403_B090_B432DEDCB159
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3F41980D_B681_488E_9757_0C9744F9C3CE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3F6DA8BB_3E45_44E2_B494_C55BEAF3B41E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.40B00DF3_37D0_4A08_B2D6_34FBA7384F4A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.40CA90F3_4098_4877_AE87_23EB612B18C7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.411F83B1_A0EC_4155_AF99_0137F5EFB270
mov ecx, 0x5b5b90
call fcn.0050f680
push str.41349826_5C7F_4BF0_8279_5DAF1DE6E9AE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.413754F1_3BAB_43FF_B654_D58D12C393E6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.41700749_A109_4254_AF13_BE54011E8783
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4193BF7B_0C6C_4C23_B295_20F72F97938F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.419EDA30_6DFF_432C_B534_E15D899ABEE4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.41CEBDC0_32C1_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.41E1565D_B7A8_4251_BD79_E6C5FACB2B5F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4201428F_7885_4513_B98E_BF6557375CF8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.421745E9_16DF_4EE4_A758_D51F939C49CB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.42B62410_E79C_482D_8252_7623413EB5A5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.42BD9965_303D_4CFB_AAE0_DCADCB791A55
mov ecx, 0x5b5b90
call fcn.0050f680
push str.430981D5_5D8D_4B85_9EB1_8E44E26EB9BA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.431532BD_0AE1_4ABC_BE8C_919F3D1332E2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4331EC56_0AAB_499E_8757_DD2EE44AD671
mov ecx, 0x5b5b90
call fcn.0050f680
push str.43488356_3CCF_41B2_9050_D54928222E41
mov ecx, 0x5b5b90
call fcn.0050f680
push str.44230BC0_3105_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.44A36944_22C6_4A08_BC7C_161F3E540DBF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.45150DDC_8229_44A8_8640_1A8603D5AF73
mov ecx, 0x5b5b90
call fcn.0050f680
push str.45186466_7A6A_470D_B347_411A881FD042
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4526BE9B_DA99_4608_9EF9_6F25C8956B58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4534CD6B_59D6_43FD_864B_06A0D843444A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.45D59156_647B_4B06_B20E_0E297A1077BD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.46068B94_FFF5_46A3_9A01_545654523B2C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.462862BE_9A5C_49A5_9CBD_A649EAC63645
mov ecx, 0x5b5b90
call fcn.0050f680
push str.471C09A8_26A2_4061_B2E0_345FA0DA7129
mov ecx, 0x5b5b90
call fcn.0050f680
push str.479B1AEA_4414_4E43_8CBF_94BFC7C69B56
mov ecx, 0x5b5b90
call fcn.0050f680
push str.47AC7905_BE5E_438B_B3CF_F6159FF708FE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.47D8F3A0_C511_4D91_A963_F00DDDEE4E49
mov ecx, 0x5b5b90
call fcn.0050f680
push str.48D78BE5_CFB9_4B66_9AC4_96D4CF21DE06
mov ecx, 0x5b5b90
call fcn.0050f680
push str.48E92754_2DAF_4DE4_8385_34F631580E9B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.49160F0D_6BE2_4F5F_BCDB_9256DA3BB120
mov ecx, 0x5b5b90
call fcn.0050f680
push str.491BE5B7_A7F8_40EC_AAD4_CBA11FDFD814
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4937D5D1_2039_409A_BD83_FEC9B39B2356
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4A2AACF1_ADF6_11D5_98A9_00E018981B9E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4A2ECC12_46BA_4C52_9749_C0FAF38D507B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4A3666F3_5F2D_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4AA76F27_81BC_4C3F_9F24_CB99349C8CC9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4B0FCEB7_8163_46EE_9EAF_85BD933D0A46
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4C3B62AF_CA25_4FBA_8405_32E44F83BB6F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4CD72DDB_061E_4366_8A47_BABDE2DCDBA0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4D0D7583_7EEC_4235_90A5_AE141949FD4F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4D1C4E8A_A32A_416B_BCDB_33B3EF3617D3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4D1C4E8C_A32A_416B_BCDB_33B3EF3617D3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4D25F923_B9FE_4682_BF72_8AB8210D6D75
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4D6079CB_FD9E_46AF_A896_6E8582E52827
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4D71E392_B4B8_4452_AEAE_631F3AAB51B1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4DF1BF01_8C62_4456_8CC6_FD65638003F3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4E3645AF_7A81_4F83_9B8C_1E4F930D873F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4E6354DE_9115_4AEE_BD21_C46C3E8A49DB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4E8B851B_05B0_4BAF_B24D_D0DFE88DDED3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4FC63700_2093_4AD2_8D37_3B3D86D9C940
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4FD8645F_9B3E_46C1_9727_9837842A84AB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4FDBDBAD_FEFE_4C4C_9CC1_1181052AFB12
mov ecx, 0x5b5b90
call fcn.0050f680
push str.500D7297_28BC_4999_96DC_688C23F3C347
mov ecx, 0x5b5b90
call fcn.0050f680
push str.50C3E2B3_4FD7_4CB9_91F9_641A6E6B3689
mov ecx, 0x5b5b90
call fcn.0050f680
push str.50C4CDD9_22D7_49FF_AC6D_7D4D528A3AB2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.511A9BB1_917A_414A_88FD_3128E37032A1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.51958167_D5E3_11D1_AA42_0000E842E40A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.51958168_D5E3_11D1_AA42_0000E842E40A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.51FECD64_C2C5_457D_9929_04DEABA6AEE0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.525C8F79_9BEF_4F76_A28C_27F1E71BCE5A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.52F3ADB8_D062_4622_94FB_C0374DC4A94E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5326B223_DC21_43A4_9B79_635E2D18DCB2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.53C3126A_D296_46CF_9313_5D9A139222C3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.53FCF355_5323_11D0_A864_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.53FCF35A_5323_11D0_A864_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.53FCF35B_5323_11D0_A864_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.54286C3A_E044_4E65_BD44_528D6AE28A18
mov ecx, 0x5b5b90
call fcn.0050f680
push str.542FA950_C57A_4E17_B3E1_D935DFE15DEE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.54B287F9_FD90_4457_B65E_CB91560C021D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.54E16983_0202_43EC_9CAC_5B8F7493BB80
mov ecx, 0x5b5b90
call fcn.0050f680
push str.54F37842_CDD7_11D3_B2D4_00500489D6A3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5533CB30_15CD_40DD_855F_8C2E1FCDE7D7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.55587710_CCC9_4EB4_9A7B_8448B7AB26A7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5623D216_E8FF_4C50_AE30_EDB906274C7D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5638ABDA_4C34_43A1_B4C9_F377CA50D5B0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.56EBFFE6_9557_46C2_A322_DB1DF5CAF199
mov ecx, 0x5b5b90
call fcn.0050f680
push str.57A7034F_87D9_4EA2_B3AC_C1C1B5296035
mov ecx, 0x5b5b90
call fcn.0050f680
push str.58359012_BF36_11D3_99A2_0050DA2EE1BE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.58B6A03D_69A8_44D5_8E9F_7D32A6627F13
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5938902D_33E5_4590_88F7_8901C829AD91
mov ecx, 0x5b5b90
call fcn.0050f680
push str.59399E33_FB54_48AB_8AE4_AE108B36DAB4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.597AA130_F00B_40B8_ADAF_529D4DA9BE52
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5A4E1627_8677_41F7_B78C_4CACDF5B12FF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5A635A91_C303_45C9_8DB9_F759D98A3B9D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5A9961FD_B0A6_4065_9552_EBFC199683A3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5B035F86_41B5_40F1_AAAD_3D219F30244E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5B1E13A0_004B_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5B3142C6_A130_4BBB_A997_554C7F561D25
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5BF0CE3E_61D2_4A7B_BAA3_0C4667A9563D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5CDE145A_B6B9_408D_A8CC_F9CA040BA7A4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5D16197A_1EAA_45AF_B29A_69F1AA055E87
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5D30F537_F73A_40E4_9F57_06D51C169CC8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5D9C84E7_FA45_49E2_A0B8_B6B5E9A4F6BE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5DC1A182_0F90_4133_A9D1_821034781305
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5DF6CE40_0B50_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5EED48AA_F20F_4085_B8F8_57724B7C5B08
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5F2B9DE7_F878_4762_8CFE_E9C58F082F0E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5F548D7D_01E2_4594_8F23_3B25C3DDD79E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.601A9784_1114_4089_9B3E_CBD70DAFC6AD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.604EA016_1EDE_41E6_A23E_76CF8F2A4808
mov ecx, 0x5b5b90
call fcn.0050f680
push str.609F107D_88EE_4D19_B56F_6C21A3E9DC1F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.60D51AA2_9ED7_48E9_BC4E_195E04E1EA2D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.61032A65_2371_4C89_B5BB_DF73090FB5EA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.61794740_B3BA_454E_8EA6_6A818D79199D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.618AAD04_921F_44C2_BE38_C0818AF69861
mov ecx, 0x5b5b90
call fcn.0050f680
push str.618BE527_B7F5_417C_BC51_98FDC2D6DE61
mov ecx, 0x5b5b90
call fcn.0050f680
push str.61A63254_6608_47C7_A351_BE9212C49C62
mov ecx, 0x5b5b90
call fcn.0050f680
push str.622B1FAC_EA01_43AD_8626_413A50C934BB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6247DD2C_8CF9_4041_A235_93691D71B8B4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.629CD6C2_E4C5_4554_AEB8_12E4E2CD40FF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.62B0B239_F9AC_4A5B_BFAE_62C7A23F7627
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6365AC7B_9920_4D8B_AF5D_3BDFEAC340A8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.636FF82A_830A_42EA_938B_6DC78B2AC30C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.63B82FD9_4958_41F7_BC2F_42F25663AF76
mov ecx, 0x5b5b90
call fcn.0050f680
push str.63D0ED2B_B45B_4458_8B3B_60C69BBBD83C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.63D0ED2D_B45B_4458_8B3B_60C69BBBD83C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.63D2A451_3351_178C_7BC4_13C4D58A7652
mov ecx, 0x5b5b90
call fcn.0050f680
push str.63EADAA3_1CEA_43E0_A7DD_EB46DBA8A47E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.64A5BD22_8D8A_4193_9CF8_7DB5212ABB17
mov ecx, 0x5b5b90
call fcn.0050f680
push str.64DF7061_17E8_4063_9723_27428076DE26
mov ecx, 0x5b5b90
call fcn.0050f680
push str.64FA8E69_9E8B_4529_964A_A3AF7780E5F8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.65B07D06_95A1_409D_93FF_8CB14E1EC86A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.66189AF2_7726_46E8_8628_0F95AB854792
mov ecx, 0x5b5b90
call fcn.0050f680
push str.66314474_D895_4D98_944E_3F344EF01A4C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.665AC8E7_8B9B_40D9_A24D_C134052B6168
mov ecx, 0x5b5b90
call fcn.0050f680
push str.66C22569_F05C_4A70_A142_763B337E1002
mov ecx, 0x5b5b90
call fcn.0050f680
push str.66D31A70_9E07_41CD_9482_2F819B9BE7CB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.670801FD_C247_4E44_9424_69E5D77C6725
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67925164_C4B6_11D2_B9C6_0000E84F59A6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67C076F5_9FDF_44CB_9180_FA7E9D5B75DE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6813BFFD_BE81_4613_B4E6_AA7ED0DA8659
mov ecx, 0x5b5b90
call fcn.0050f680
push str.68B8DCDB_EFA4_420A_BB8A_71B9892A2063
mov ecx, 0x5b5b90
call fcn.0050f680
push str.68CB2E59_3989_468E_AB68_430ED785B2E5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6912BEB3_E20C_4953_8C8E_E91B12B55BFC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6986A6CE_9D58_11D6_91C2_00E02964E8E3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6986A6D0_9D58_11D6_91C2_00E02964E8E3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6A198FC3_51AA_4403_B281_168F86D9053A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6A288140_3E1C_4CD9_AAC5_E20FDD4F5D64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6A4B7D17_1DE9_4C14_8ADF_EB4C07060519
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6A6EBAE8_8C66_4675_B423_95B3BA530940
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6A7807F7_1D10_42DD_ABA1_450AB9380E8E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6A934270_717F_4BC3_BA59_BC9BED47A8D2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6C0BEF14_A280_4515_BF87_C7A3367C3BC3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6C434537_053E_486D_B62A_160059D9D456
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6D24940D_83AE_4A69_B1D6_689D5160E8F3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6DEEE498_08CC_43F0_BCA0_DBB5A25C9501
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6E4C7AFC_9915_4036_B7F9_8B3F1710788F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6E6224FD_1E7D_4897_8407_C9F4023A70DA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6E74766C_4D93_4CC0_96D1_47B8E07FF9CA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6E83AE1C_F69C_4AED_AF98_D23C24C6FA4B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6EAD366A_19DB_46D6_8D24_337D424111D4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.700DC0DD_F409_42E0_9DE5_21EE1A2BA9FD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.70DFBEF5_DC3D_4468_A262_C23BEB5813ED
mov ecx, 0x5b5b90
call fcn.0050f680
push str.71237FD0_9DF9_46B3_8F1C_6F2998543EA2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7142C3E1_1FE1_4A2A_B882_681DC7DB0D30
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7227E56F_8FE9_4FF6_8BBF_537DE39450E2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.726CEB40_3BDD_484C_B1E8_E8A395100A45
mov ecx, 0x5b5b90
call fcn.0050f680
push str.726F0AB9_B842_4AE4_90C7_230E233E6A99
mov ecx, 0x5b5b90
call fcn.0050f680
push str.72B41EFF_D0D8_4AD5_8890_33174DDE6B82
mov ecx, 0x5b5b90
call fcn.0050f680
push str.72B62B40_17D1_11D1_96A7_F8E906C10000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.72EE7F04_15BD_4845_A005_D6711144D86A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7327F0FF_165E_46B5_98C2_80D738A3B228
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7371AD3F_C419_4DC0_8E8A_E21FAFAD53E0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.738CB0ED_54A7_4061_AE2E_40EFD9B1EEF6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.73A77F6A_C2C9_4F7E_AD8B_3EC0A7877185
mov ecx, 0x5b5b90
call fcn.0050f680
push str.740904E0_0BFB_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.741DE825_A6F0_4497_9AA6_8023CF9B0FFF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.74289A79_E652_4A57_A6B9_EE64AD532A8D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.74289A7A_E652_4A57_A6B9_EE64AD532A8D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7473D291_B7BB_4F24_AE82_7E2CE94BB6A9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7473D293_B7BB_4F24_AE82_7E2CE94BB6A9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7473D295_B7BB_4F24_AE82_7E2CE94BB6A9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7473D297_B7BB_4F24_AE82_7E2CE94BB6A9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.748742A2_159F_4DC7_8FD6_5E293708B4A7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.74C012C4_00FB_4F04_9AFB_4AD5449D2018
mov ecx, 0x5b5b90
call fcn.0050f680
push str.74EEB2E7_8B18_404B_AAC6_79B2D71F4B10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.753D6C0F_960D_4640_B718_A9B1AC53AB78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.75BF416E_4326_45B5_8A2D_AE32D05B930B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7682C1A6_C500_4C78_93B9_5A76A91520F8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7683D91F_4C61_4DF1_8C6F_1F06E23E30B5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7818B6D4_A9B1_4A67_98B6_073A0D2F4192
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7827CCC3_0DEB_4CFB_911C_AA777C882007
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7827CCC3_0DEB_4CFB_911C_AA777C8826EA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.78888F8B_D5E4_43CE_89F5_C8C18223AF64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.788C6F6E_C2EA_4A63_9C38_CE7D8F43BCE4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.78BCF936_45B0_40A7_9391_DCC03420DB35
mov ecx, 0x5b5b90
call fcn.0050f680
push str.79181893_ADB9_442E_96B6_C8175C6B0BD3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.79B13431_CCAC_4097_8889_D0289E5E924F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7A2F6251_6C99_4DA5_9827_954EB45DCB82
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7B178417_3CDA_444F_94FF_312C0A3A78A8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7B8BD940_B1EF_460C_85A2_9ACAAF7F9303
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7B9A715E_9D87_4C21_BF9E_F914F2FA953F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7BB9E6B0_96B6_41A6_B01E_363DCEC652C9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7BE68951_EECC_4CA3_8991_FC2054D1F7E6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7C479D09_1280_41D2_945F_2377736B8CF7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7CA36000_3320_49D1_BAD1_4C5169D4084A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7E335D04_2E6E_4D0E_A921_C3D9192E7121
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7E7A1949_5C0C_45F3_A106_34FE038493EF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7ED983C3_FAAC_400C_BBD4_F519D74FF188
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7EDB76F4_F22A_4DA4_BD19_95C1DDDF172D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7EF46B75_6E55_403D_94B7_860FD1E52374
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7F23592C_8F2C_4C08_83A8_BBE01BF9CC64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7F4E63C9_F30C_4424_9BAF_B6896F5F56C4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8028B940_4932_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.80C37A37_AD99_4FD3_9F67_BD7A64F3C35E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8131F530_649E_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.817124FD_F3A1_482D_9AC5_36804E666581
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8216BD4A_4DC2_4DCE_9AFF_C86C5ACC6757
mov ecx, 0x5b5b90
call fcn.0050f680
push str.82C6C396_DD7B_4CE5_B668_C0087D1F3A1F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.831CBAC4_8283_4653_9D81_FEB9F3F6E47C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.83453070_3F9C_4AB0_BE30_EDA368D7976D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.83453072_3F9C_4AB0_BE30_EDA368D7976D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.835A4DA1_778A_426B_AF73_6A4C5E11B8B9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.835BED79_DF7E_4096_B355_ED43FA2EA87B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.83A13E87_FA20_4B6A_AAE8_C1226B5E1573
mov ecx, 0x5b5b90
call fcn.0050f680
push str.83E8B772_A8D5_4CF5_B0EF_5DF3AB80B7FA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.840E112F_3D24_458A_AAAB_67E5AAAD031A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.841098DC_EEA3_4332_9C67_51CF88FE66A7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.84F2D0D3_79DE_42CD_B8BB_F7DBAEBDDD4E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.852DFDF3_59C0_4683_BDE1_D828A95C6D9D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.853E0D78_F4C2_47CB_A3F5_A774DA60DFCD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8578D35E_C6C0_4808_9A80_0F6C29A2C423
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8654592E_952A_4E7C_A960_304763B35FA6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8654DE3D_6D0B_4965_9819_8502384C9C3D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.86D5EB37_F971_413C_A587_6D7ADF613A79
mov ecx, 0x5b5b90
call fcn.0050f680
push str.86F8ADB5_368D_49E0_8CEF_182A5DCC3605
mov ecx, 0x5b5b90
call fcn.0050f680
push str.886903CE_0C3B_485C_8F90_582EC1D1CFA5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.88FAFB53_6131_4801_8593_BE5A467F56AD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8911F1B1_5AB7_42DB_B750_0D9AF843C831
mov ecx, 0x5b5b90
call fcn.0050f680
push str.89D74F0D_1AC4_4351_A46D_19CFF0483B1F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.89E141F8_0F61_4230_85DF_40DC0F94E4CF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.89E60215_CA26_4A75_B384_E0CCC5FF35DA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8A5E6109_376F_46A7_AE78_714BF8F611DC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8A61A950_C325_4F44_BA64_273180FF3464
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8AD9AD05_36BE_4E40_BA62_5422EB0D02FB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8B05763C_E4EB_4ECC_A10C_EE950C797C47
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8B8558F6_DC26_4F39_8417_34B8934AA459
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8B8F6968_2F24_41E3_B653_E9613226F14D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8C8D5C57_3CAD_4CF9_BCAD_F873678DA883
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8C953EC4_8CFA_44FB_B32E_1249E5505091
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8CBED98F_8DDD_4AF0_A9EA_C75E10C937BC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8D12E08E_651A_4810_91E2_0166D4C72C4B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8D2FE65B_7DCE_44AF_B664_556F289BCAAC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8D5C4EC6_AF8E_4B85_BA27_64BABE410510
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8DAE9202_0019_4D30_A5D2_AAF02D4DDC37
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8E863BD6_50DE_47D0_A6F1_3C1F6DB72451
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8EBB1743_9A2F_11D4_8A7E_0050DA2EE1BE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8EDD9C3F_7AAB_4A50_9F7E_2DE6F3E293C7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8EE388CB_A53E_49EA_9E0F_9CCFA1C016B7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8EEE58D5_130E_4CBD_9C83_35A0564E5678
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8F15B157_40D9_4B20_8D3B_B1F8B475B58D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.90449521_D834_4703_BB4E_D3AA44042FF8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.907977FB_8835_483F_9979_AE3101DD3D17
mov ecx, 0x5b5b90
call fcn.0050f680
push str.90F62EF7_58D1_4E8E_BB3E_CFB10BA9E47B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9132E380_DC21_11D0_A875_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.91397D1F_1446_11D4_8AF4_0040CA1127B6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.917CAAE9_DD47_4025_936E_1414F07DF5B8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.91CF619A_4686_4CA4_9232_3B2E6B63AA92
mov ecx, 0x5b5b90
call fcn.0050f680
push str.91D91D21_8008_429D_821C_7266AAC84A9F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9202E18C_1CF0_4960_AA85_68C918CBCF38
mov ecx, 0x5b5b90
call fcn.0050f680
push str.923967E3_2D6E_4230_A7FE_EF9AA4609415
mov ecx, 0x5b5b90
call fcn.0050f680
push str.92969CED_2671_468A_A23A_63B043E3786B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.938DF220_B3ED_475C_ACBE_46BD0D4B3FF4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.939CBB64_212B_47C5_B610_38B5811E630A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.93BF8F00_DBE8_11D0_A875_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9400383A_75EB_4604_9EC2_DA67C3B77226
mov ecx, 0x5b5b90
call fcn.0050f680
push str.94786C47_EB3F_4BD5_A66B_0D49E2C90541
mov ecx, 0x5b5b90
call fcn.0050f680
push str.94DBDB63_5F05_4C51_8B14_DE0CA12EF4CA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.955CBF48_4313_4B1F_872B_254B7822CCF2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.95B92D92_8B7D_4A19_A3F1_43113B4DBCAF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.95DE3A2C_DF48_4CDF_9BC8_36BAEE2288E2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9603A736_05B9_4D78_BDD5_BDCB0914E522
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9647FB70_DC0F_11D0_A875_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.967A494A_6AEC_4555_9CAF_FA6EB00ACF91
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9692BE2F_EB8F_49D9_A11C_C24C1EF734D5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9757C0F5_175E_4249_8484_4F5666C88787
mov ecx, 0x5b5b90
call fcn.0050f680
push str.97D38D61_46BB_4FC7_B21E_9E49F8F8FC66
mov ecx, 0x5b5b90
call fcn.0050f680
push str.97DEA3CB_DB02_4DCA_A86C_C891DF24E6B1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.97EDB0FD_D47D_4947_B50F_EAF918152EB2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.981334CB_7B8B_431F_B86D_67B7426B125B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.98B2DDBA_6DA2_4421_AF2B_814E98F53649
mov ecx, 0x5b5b90
call fcn.0050f680
push str.98F33BE4_FCBC_4704_A26C_863A6C0B175C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.991AAC62_B100_47CE_8B75_253965244F69
mov ecx, 0x5b5b90
call fcn.0050f680
push str.991CEF4C_30D4_45F1_BD3E_B503D7C88B9C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.994A0535_B09C_4D1C_AA4A_2F76002349B1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9989A9BC_9828_467E_AF06_E3B279E6E97B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99908473_1135_4009_BE4F_32B921F86ED9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99AA88D1_D9D3_410A_BE9E_044F94C183DA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99ACA0F7_D864_45CB_8C40_FD42A077E7CA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99CCFB8C_6380_4A14_8FDD_EF3E7E95335D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9A395C6C_E42E_4777_B8EF_FDDEB705F3FB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9ADDE7B5_93BB_46C9_AB5C_D975B7D32A16
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9AF74448_EBD1_484C_8B06_35E597C0B54C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9B622DE7_8A48_4274_B7B0_7D03A148FBC0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9BAB764B_E4F3_4C7B_99AD_CDF636BBE3A8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9BF068D0_B735_11D3_B2CF_00500489D6A3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9C221A6E_9EC5_49CE_9271_86A4660A932D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9CA1536D_5689_40CA_B92A_F646301517D7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9D4548CE_92FD_4C6C_AE7F_3DBE3BC763D8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9D573D0E_663C_435F_BF31_2C4497373C41
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9DB46422_FF61_11D0_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9DD36F1E_5111_41C5_ADED_A2A11A2FF3E4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9E393F82_2644_4AB6_B994_1AD39D6C59EE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9EF2C0CC_2DBF_42F3_869C_1C44D751E143
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9F61CFDF_5C79_4D35_B4DA_766B28367223
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9F7457DD_11E9_404F_A951_DAFEE5DC6FB3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A0881AA1_68BE_41AC_9C0D_4C8A69C6C72C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A0E2E5AB_C02F_489B_BD7B_58C329F774F3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A11DCB3A_D50B_497D_8792_4B25FFDF0307
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A13D9B20_DFCE_46CE_894B_1D6A4F688F13
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A1C23BA2_8F20_4C01_B663_7FF2B3421194
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A1E7709A_3AFB_49B8_8719_CCBF3F73CCB1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A2BA5E71_5BE3_4007_AC48_157823FB63FB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A2FB8217_E320_434E_BA79_513E357AD54F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A3080819_9A46_4ACF_AA24_B34D59715C5E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A36A5936_CFD9_4B41_86BD_319A1931887F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A3A2A5C0_1306_4D1A_A093_9CECA4230002
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A42C0EF4_1C76_43CC_989F_EADC7E4B755D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A44CAB15_6B7E_406B_9D9B_B1C1C6BA8CDB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A466127C_4574_4D64_848E_B52C6007BBA3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A4BC67F0_6C90_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A55C3BA7_DB1E_4652_867E_055CEAFE8018
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A5802370_FAFF_45B1_A223_5E184E98A82B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A5F6C90C_ABE4_4C57_A421_8C5A202AA9F8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A626CDBD_3D13_4F78_B819_440A28D7E8FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A64E2C3A_4C7D_428F_948C_EE5D3D4105DD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A69107CC_BEC8_4A34_B474_211B0F46A764
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A6A08CBD_6673_41B1_B997_3F83A25B45B0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A76556B1_6E37_49F3_8815_595F05A5B37A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A7C16B8F_9EEA_4E6B_ABF8_34E492E14019
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A8018C54_B702_4D52_9ACC_8CA78911E633
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A824BDC2_8326_49A9_B465_FBA17B5D5C05
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A83E42B1_1AE7_4CE6_B128_AB0F4A126B2C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A87F2637_2D4B_46DC_8948_82A4451EFD70
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A88271FD_3162_4789_B742_CCC7F78ABCD3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A891CA6A_FC82_46A1_9731_5F7A7EC0FDD9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A8C761D6_31F2_429A_BF1F_63B416AC87EA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A8D2DCEA_D78E_486B_B43C_E2AF008E782B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A92616B1_2E82_4052_B579_0A40C2304380
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A9379648_F6EB_4F65_A624_1C10411A15D0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A99AC77F_4DE5_4AA2_810A_35FAB5FC114B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A9B28EF6_ABF3_463B_A3D8_4D0D0BADFADC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A9CEBBF4_9129_479A_9231_E833ED3D3A8F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AA760BA8_5862_4BC5_9263_4452CBC0B264
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AACCE1F1_F0AD_429F_83D9_941BCFEA335F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AB45CE36_C280_4525_BCF9_1BD01D3E4B57
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ABF441B2_9B57_4838_96A0_34B1CECD4AA5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ABF7C4D4_53EF_4C15_8951_D22F63C98E9F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AC2A5E17_05ED_4E62_86E5_84779E8F0BCA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AC368F5F_6670_4DDE_A1A8_B9C064EA0402
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AC50DF8B_B632_42C0_857C_2A9B7C509BFB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AC71B60E_94C9_4EDE_BA46_E146747BB67E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AC9F8055_F1D1_4B8E_B084_8B589FCA7981
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AD5BC1F0_72D8_44B3_8E3D_8E8FECCE43FB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AD6BD17F_DB0E_455E_BC47_DE96BD7D09F4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AD9A7B03_BE12_11D4_B493_00D0B77F0A6D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AE772DE0_743C_4FEB_A4D6_31CA5F6E3DCD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AEBF09E2_0C15_43C8_99BF_928C645D98A0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AEE96320_2131_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AF15975B_1498_4740_8E6C_90AF78E4198C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AF4DA69C_E1D6_469A_855B_6445294857D4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AFBFEC7C_6D3B_46AE_A2C2_C7BE47DDCCAB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AFD4D1F9_167C_4884_95AE_B5A9797B0D16
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B0E8C398_DABE_4CE1_B4D9_ED43B64923F5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B1317C08_617A_435D_A24F_A930F4540696
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B13281CF_8778_4C98_AE23_ABBA4637A33D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B195B3B2_8A05_11D3_97A4_0004ACA6948E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B20D7ADD_989C_4BC0_A797_F6FE7998EFD7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B27EAE33_4F84_4F8B_9135_979341D206FE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B2B3702A_5425_489E_A3AF_EDCCAFEBA019
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B2B92BC9_E149_4EE8_A93E_0B8CFB329808
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B32E258A_8ADE_4DAD_92F9_476A81824D6F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B3BA5582_79A9_464D_A7FA_711C5888C6E9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B3EAD50C_ECB0_459A_9EDA_F505AB99675B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B44C56FD_31E9_4FAE_A4DE_60EDE0F32B9E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B4F8A926_E57D_4C9E_A93F_F3CE0D07A3E4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B53D4CD4_406D_43CC_8244_7893D72236DD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B548B7D8_3D03_4AED_A6A1_4251FAD00C10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B5533239_2826_4FA8_BCFB_A9A44008FF4B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B576FB0D_DC7B_4833_B4C8_651DC42F5965
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B5CAC49F_A118_40D8_87B8_4B7883BAB681
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B5D2ED96_62F9_4C2C_956D_E425B1F67337
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B671426C_5C1A_48AC_9652_BC9402B1C404
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B6DEAEE0_1E32_4A1B_916C_8E3EF69DABD3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B71C7D9A_DA43_4E8B_BB9B_1684AC2AF324
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B74B2B6C_9B8D_47D9_872F_E83D475AAF34
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B755E84C_C31B_49A8_96CC_855BC26DA5BA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B79D9232_A798_43DB_9E61_281D550460E4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B7B84995_8B92_46BF_94AA_FA2F3DD23B84
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B7BD126F_654E_45CC_8BDC_909FDBEB583D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B88A3AF1_4F1B_4400_8FFB_3FCB108CE115
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B8CFDC9E_E634_40E3_A51E_C097F23D53B9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B99A727F_0782_4A71_BCC2_6E1E66414904
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B9BB3219_F84C_4060_966B_4A1E73E24226
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B9CC2B92_5611_453F_8381_8B6F72D9C0B8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BA0017FE_829E_4460_9DEA_B969BA166B85
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BA221B24_C60D_4A6C_A8BB_59808FDA4C80
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BA6FFBD5_79EE_4A01_965B_FE089A37E505
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BAD37BC0_2231_11D1_9951_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BB0D5ADC_028D_4185_9288_722DDCE2C757
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BBABDC90_F3D5_4801_863A_EE6AE529862D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BBC51E44_71C4_4766_B55F_5A0A23BA9DED
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BBCC290A_5E32_4E54_80DB_F0F3F3892444
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BC12B055_C9F5_407D_9B66_1851973F32AF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BC190DA5_0187_4D99_B3AC_6C45EA1B9324
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BC333116_6EA1_40A1_9D07_ECB192DB8CEA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BC8E5D2C_2890_4F37_B341_A94D18C010AB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BCD0C200_69C1_11D1_8AF8_00609761C47A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BE89FFB3_7F9C_4A16_B475_98B195A06628
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BE990A32_C2EC_4654_8FD0_26FECEA81998
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BEB656B1_CAC1_4591_B4EA_66793D53961B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BFC20A15_B0AC_44CC_A25A_A7039014BA9F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C0C6F0AD_C60B_4E54_B476_DAF301CDE902
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C10A8C42_6542_4478_B9F3_2A0FB3101506
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C17072FB_FCA5_462A_85F8_8A4B95709CD6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C1C2FC43_F042_4F17_AEDB_C5ABF3B42E4B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C1C56112_2B2E_4D3C_8CFC_7E10C77FACEF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C2CCBFAF_1474_4E53_8130_0CC12B31856B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C2E6831B_822B_4A1F_9EF1_1D3EB7D3E985
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C3F45F54_15BA_4B1F_B8C5_A9B8B3F85435
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C41A1C0D_EA6C_11D4_B1B8_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C41A1C0D_EA6C_11D4_B1B8_444553540007
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C41DEBDA_3C92_4A69_B118_726BB57C8D85
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C44FEFF4_EF0C_4CF7_83D0_92B4266A32B9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C4543E64_1498_410D_8E72_4744EEA99AB9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C47788B1_9604_4D7A_A684_F4D450F2D7D2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C4FEE4A6_4B8B_11D4_8A6D_0050DA2EE1BE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C6290651_8127_4689_A40C_E2A1951FF835
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C6906A23_4717_4E1F_B6FD_F06EBED14177
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C6906A23_4717_4E1F_B6FD_F06EBED15678
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C6A846C5_D67F_48B4_8552_C22354E56966
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C75A779B_714D_420E_A41C_838BC136D026
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C7779D80_C0E5_4348_90E0_55FBA0274BD9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C7EDAB2D_D7F9_11D8_BA48_C79B0C409D70
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C7EFDCDE_A181_41D0_A551_16F73B398040
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C7F127DF_8877_4E1E_A196_FBBECBC5BC6D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C83564CF_59F3_4332_A83E_D6FAA9BA5F35
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C89435B0_CDFE_11D3_976A_00E02913A9E0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C8CEEEE0_17D6_11D1_96A7_F8E906C10000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C8D424EF_CB21_49A0_8659_476FBAB0F8E8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C91E8926_D4BE_4685_99F4_0D996B96BAC0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C9679631_7060_443F_BD37_88F9410ED8C3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CA3B41D0_D4C1_4808_B248_75DA27238828
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CA5ED456_9ECB_4734_A64C_0546147A0CC2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CA926A2F_1A62_4203_9253_A31933A0D405
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CAF9D798_C659_4B9B_8E19_EE27C3D04EE7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CC1725CD_1EFA_4D88_8987_5EBF66347856
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CE557B85_753F_489E_B0CF_C90E0158371D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CE5ECF63_6065_4B92_8B7E_72B5042C2F25
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CE7C3CEF_4B15_11D1_ABED_709549C10000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CE9B37EC_D243_47A2_83DB_3A8350175193
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CF1E4638_637F_499D_8309_FD71B9750ABC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CF54BE1C_9359_4395_8533_1657CF209CFE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CF5C9FCE_C963_49E5_A3A4_0A81FFFE1E55
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D008677D_5759_403B_B09B_724B46C22E76
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D01D4AAB_22C5_427F_A941_C4B65A3D8A23
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D02E159A_9FA3_431A_B08E_E950E7ACBF24
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D082721F_4BD4_4B8B_BB82_06753EE6174F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D0894D60_6C6C_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D090E12D_B79C_4B82_A76C_0E3BBE73C9EF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D1951679_1D52_43FC_9585_0737143585F5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D198915A_8DBC_43FA_943A_D0E68F2275FA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D24F9D3C_5D4C_47F8_9AB7_632B44AD6A0D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D273D427_57C6_4B12_860F_BBB8195F6E2A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D2B6A471_AA46_454A_95DA_F5AD73C075E1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D36E1424_9DDF_42A5_A895_99583E13645D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D3A412E8_1E4B_47D2_9B12_F88291F5AFBB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D3D743C2_3523_450A_A432_2B25169141C1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D4480BB2_36CD_497B_83FF_15350EA6C122
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D4A2FF6C_087F_4D40_8DFE_92AAD484BFB8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D4BFBB89_4BC5_4D13_8D3A_75EDCC0CF50C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D4D390BE_98E6_4633_AD1B_B18B54BE5E76
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D56C35E6_720F_451D_A85E_E07317479F3E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D579E3FE_AE7E_476D_86D6_0950C22D90AD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D5B72AEC_E54A_11D6_B1B2_444553540000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D64348B0_6169_4AFF_88EF_E2B2610EA564
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D686DB39_659A_491A_A35C_60B99495C16E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D6FF3684_AD3B_48EB_BBB4_B9E6C5A355C1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D80A56D7_451C_41CF_9A74_1447E0887B97
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D8560AC2_21B5_4C1A_BDD4_BD12BC83B082
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D88B9D5C_A9CF_4C69_906D_1CCA5D85A2EF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D8E3D728_0F31_4479_B936_35EED7015282
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D929B5F2_1CF3_4564_9A03_FC3FDD588064
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D9E510C8_1BA8_4A3F_A06C_97286D11BF81
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DB1F5554_582C_4F53_82CC_458D2C04A2F1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DB312456_E762_4369_844A_AED9006B1B2F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DBB66602_E073_42C9_815A_1ECE9B08450D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DBF33E89_1784_42AC_ADE4_A428F56550A3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DC065FA6_08F9_4C50_99DC_275D16CFC5BD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DC21CEDE_3B81_43D7_B816_DAEFA7B4901F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DC23459B_4904_400C_BE7C_2992BEEE615F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DC7584B0_2972_41A3_9965_29EB177E6160
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DCA4E955_7C7A_48B3_ABAF_5D303D17F7CA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DCFAB192_4A0E_4720_8E24_70D5F0CB8C39
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DD469A88_316C_441D_B712_783D9B9A6707
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DD521A1C_1F98_11D4_9676_00E018981B9E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DDB0D689_FAE0_4165_9F7C_877602F9DD66
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DDE3D199_0B45_4B40_9A99_4623F86A9A24
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DE38C398_B328_4F4C_A3AD_1B5E4ED93477
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DE4A7692_B2CB_4D1A_9956_76A8A028CAA0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DE85A67A_3F04_4ABA_A10B_A37B220AFB70
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DEBA1742_2BEC_4B78_A987_5837971193F7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DF76E9B7_35EC_46FC_AF56_5B79DED9D64F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DF84E609_C3A4_49CB_A160_61767DAF8899
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DFB574F4_1846_42F5_9694_1F09223800F9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E0110779_5F79_4685_9C96_9D99EFD30CA2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E01AD640_F87D_11D0_9A50_00AA004812C2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E0D689BA_BD66_4A78_9A1F_2781F0E5DFF7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E18B69D0_7E9E_4C6E_BDD8_879A1FFF7123
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E1A34336_B519_4127_806B_C0B7B82C4B7F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E1FE39D6_16A2_42CA_A289_DBF0BBD47371
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E21F253B_DB1F_451B_B1F2_8B5AA5A760FD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E342AF55_B78A_4CD0_A2BB_DA7F52D9D25E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E342AF55_B78A_4CD0_A2BB_DA7F52D9D25F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E3F9A8A1_8FC1_4A4C_A2E8_F5E53554BD4A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E4245BB7_4478_4D78_B9A6_12D3EA5BEFA6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E4339DC3_C2D3_458F_BDC9_FF02F340A3F8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E4458B4A_6149_4450_84F2_864ADB7E8C52
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E4D111A5_A3D5_4097_BBE6_2EDBC0277D61
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E4DC8875_9477_449C_B166_9549CBA8E73D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E50045DD_6277_4824_B069_A511C733E0E3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E58F4168_608C_45C2_9BFF_061229730B2E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E5AD5BD5_C710_45E0_ABD3_E770FE85DAE8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E73B2C7A_190F_4B26_A220_40F6A39234C5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E775C662_85D0_438E_82F0_6BCE20A8E154
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E79B1445_DFEA_4BEF_A786_E0C0F33C863B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E79DFBC9_5697_4FBD_94E5_5B2A9C7C1612
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E79DFBCB_5697_4FBD_94E5_5B2A9C7C1612
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E7CCBD19_2EEA_4B6A_B9BE_E8A68613809C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E813099D_5529_47F4_9B37_4AFAFCB00A43
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E82431BF_E8A2_45CA_8361_E5517588CDA1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E827FFD9_95D1_4B49_BEB3_5D49E688C108
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E832FFDE_8ED2_47B7_BE50_729A238040A0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E86D0281_FA5A_4E36_B993_84FD87DA9DF1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E873B66E_B289_469F_9CC4_F716BDF95A30
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E9BBD270_4B87_4EE2_912F_6635674986C0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E9DBE13A_EB90_4112_9CAE_8E726403E750
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EA0F107F_2BF6_44A0_96C4_A99B74AFBC4A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EABBB49A_4D7B_415B_8250_15C3B854E9FF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EAF2CCEE_21A1_4203_9F36_4929FD104D43
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EB1FFFC1_5688_11D0_A865_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EB1FFFC2_5688_11D0_A865_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EB5CA3AF_26C1_467B_9A55_2820E0451AAB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EB9E5C1C_B1F9_4C2B_BE8A_27D6446FDAF8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EBA0D3C9_F019_4DB2_861C_FD373D26F6E5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EDC18412_24FD_43C7_8B38_5E67EDB57DB4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EDF57AF7_8A46_4735_98F3_AE96B3BAF6C5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EDF9F7F2_C764_46D6_B5A8_5A87938F9793
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EE03EFDC_274D_4E6A_A3A0_C3EFD8BB5FF1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EE06D877_386F_4A44_A9ED_75EB6C3E7E80
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EE06D877_386F_4A44_A9ED_75EB6C3E7E81
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EE078825_FB21_4CB3_9B24_32465A4C4315
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EF0372DC_F552_11D3_8528_0050DAB79376
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EF0372DE_F552_11D3_8528_0050DAB79376
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EF77D50B_5767_4E0E_A3A4_098670025F1D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EF99BD4F_CDFB_11E2_892F_1090271D4F78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F0084A54_47B5_4C53_8821_AB292989F57A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F019AEC4_4C95_46DE_A107_E302473E3B9A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F08555AF_9CC3_11D2_AA8E_000000000000
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F0FB3524_DA16_4E4D_99B1_BF11BC93D38A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F11126AB_5429_42A3_8FA4_D4899D23A8EA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F131923C_381D_4E4C_A472_4A17118FD742
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F16AB1DB_15C0_4456_A29E_4DF24FB9E3D2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F171A44F_7AF5_43E1_AFED_EDC826A1B0F5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F2143124_AEDB_48CC_8D8A_63FD1A3FDDFE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F273D4EA_2025_4410_8408_251A0CD46BE7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F31637B5_138E_4A12_87A6_E520EE82941E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F370F307_2AF6_4A7D_A592_818529C57779
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F4394F24_163D_430B_B5AF_B68B56031B99
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F43EC88B_B6C8_4969_A763_E2BF55602CCE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F51ED8C5_21D2_40BF_8C09_5829A1360560
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F56CB7D9_3B01_4B51_ABF3_81B3DBE63426
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F5AC8B35_5B15_4E8F_8046_43858973B495
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F5CAE14E_1176_47E2_954E_85C4EE0ECD40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F5CC5892_346B_4F19_B304_307DD1EF1A45
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F5F0A448_2BCD_459E_8743_C39154EE1CA8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F709F572_86F5_47C8_AFCF_3CEBC468FADB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F7521042_524A_4996_BEF1_D0B46A4C6124
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F786CB18_3809_4E49_BC99_9A66DA47DB8B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F7D09218_46D7_4D3D_9B7F_315204CD0836
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F7EC6286_297C_4981_9DCC_FD7F57BC24C9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F7FA2448_5DE5_4AF5_8F88_1D2BB9E6DE18
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F82FD7D4_2EC8_40B3_A141_DE051C98DCE9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F83AF01C_AA2F_469F_8BE7_D178FB15FD07
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F864100B_0250_43FB_AE95_F50C5537B178
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F87D7FB5_9DC5_4C8C_B998_D8DFE02E2978
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F94C0089_9394_4E44_B4EA_58DBA1F7B84E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F97E5B38_4887_444A_86F5_91C18331500B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F9BDB492_37D6_4E33_B324_058B22E21FFA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FA1D5414_D123_4716_A39A_1E831C56E53D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FA77AD79_09CF_41FB_B171_CC856F9E737F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FAAEB405_B7B0_4749_81DE_DF36B2D36531
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FACCC49A_4D7B_415B_8250_15C3B854E9FF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FB590D02_0A82_4F44_9FAD_517948DCF4F3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FB6C08FC_8F07_41AB_8390_E7087C30D0B7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FC02833E_9FDE_4862_974F_828887716A28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FC073BDA_C115_4A1D_9DF9_9B5C461482E5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FD42F6D3_7AB1_470C_979B_7996EDC99099
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FE063DBA_4EC0_403E_8DD8_394C54984B2C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FE063DBC_4EC0_403E_8DD8_394C54984B2C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FECA4FD3_F0F9_432E_9EA4_3EC4D4AA59D2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FEE5EB46_38B4_4BC6_8818_019490B70D7B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FEFCA7F0_6C8E_11D0_A866_0000B43699FC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FF6AAA4C_9FB8_4663_A04C_EB9D02568D1D
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c1788
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c183c
push 0x5b8dc8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c17c5
jmp 0x4c177b
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.Interface_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.Wow6432NodeInterface_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
jmp 0x4c177b
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.03C4D2E8_37FA_1100_B1BC_A7DA8F5B322A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.06O0H231_0250_MBBJ_C87V_G00VRG48F4N0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.07Y11VWU_UPYY_ATCE_P44Q_I8QQU17V03VB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.08B0E5C0_4FCB_11CF_AAX5_00401C608512
mov ecx, 0x5b5b90
call fcn.0050f680
push str.08B0E5JF_4FCB_11CF_AAA5_00401C6XX500
mov ecx, 0x5b5b90
call fcn.0050f680
push str.08U617VA_6D68_A6FC_L151_OK1IHC56272P
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0IT27HSQ_X040_X5FE_0040_8P6QI4EY2RB2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0K1DM7IA_210A_36OP_QQS9_431296375110
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0L8DLR46_D5LC_R160_XP8P_0D5C066657D0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0Q55O7T5_7PG8_1407_8Y6O_8DDRN68HAD86
mov ecx, 0x5b5b90
call fcn.0050f680
push str.10E0OBO6_5UX8_70E2_LT0B_TB0NQ1340IX4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.126YT8GV_15L1_CV0C_6R7U_NFWNJUMV12G2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.12LOP3S8_1VRX_81VS_JKL6_61OP5G3214441
mov ecx, 0x5b5b90
call fcn.0050f680
push str.13N35GA7_0A76_J045_42N2_6307H8B4X3U7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.14CE0CFF_3404_AD9A_0302_070106050800
mov ecx, 0x5b5b90
call fcn.0050f680
push str.18B0E5C2_99CB_11CF_AYX5_00401C648513
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1AD58FA5_4034_B600_0204_030401020808
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1V5SMR5P_DTEC_MH3W_PDJ3_574TPBND1T8N
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1XD015DQ_JJUA_GP1G_2M0B_7II384121TRH
mov ecx, 0x5b5b90
call fcn.0050f680
push str.23KLN5J0_4OPM_11WE_AAX5_24EF1F387232
mov ecx, 0x5b5b90
call fcn.0050f680
push str.254F4E25_A65F_2764_0003_070806050704
mov ecx, 0x5b5b90
call fcn.0050f680
push str.256C14W2_4307_17L5_O833_2WK3KRN38HN2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_21CX1C642122
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_21CX1C987224
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_21CX1C987892
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_21CX3C644141
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_21CX3C644241
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_21CX5C544541
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_24CX1C987132
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_25GX1C642122
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28ABC5C0_4FCB_11CF_AAX5_81CX1C635612
mov ecx, 0x5b5b90
call fcn.0050f680
push str.28B0E5C2_99CB_11CF_AYX5_00401C648513
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5807f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2C7339OW_2J09_4501_B2F3_C3508F2941KL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2FA00637_2A90_6A2B_0203_040808060605
mov ecx, 0x5b5b90
call fcn.0050f680
push str.30CE5BAB_8960_9567_EE35_00904295AD59
mov ecx, 0x5b5b90
call fcn.0050f680
push str.35ABC5C0_4FCB_31CF_AAX5_21CX1C6Og22
mov ecx, 0x5b5b90
call fcn.0050f680
push str.35TBC5C0_4FuB_31XF_AAC6_21CX1C6Og22
mov ecx, 0x5b5b90
call fcn.0050f680
push str.36A5A0DB_297E_FDE2_0501_060104070800
mov ecx, 0x5b5b90
call fcn.0050f680
push str.37FAPF72_OYBC_1L76_1BT3_877V52TJ2568
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3CXAH50N_S6LX_1JB5_DVY6_A6GV68OS4M55
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3J0NE400_3364_1X87_2MWJ_IO8H2JG21QT3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3W4I57X7_A2B0_M028_8643_8TD4YJV4E5GR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3W45FQ07_RMD5_8Y3B_K031_2F57068VLU58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.42X0723D_D1OR_6IU3_2M11_7V66E4WS5813
mov ecx, 0x5b5b90
call fcn.0050f680
push str.43EB5254_E4B3_4E69_6484_8E4E2C23A78E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.43XQA75S_8XFM_153O_3O63_14YHJ05TX1L4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4DUOHBS8_PMS6_Q3P7_87HN_2K08P58WS0Q4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4fz8rk_15aq_16nc_23or4_2ke0fa051515
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4INC118H_5VS8_52GJ_3X35_445LKPLWYH88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4K5O3QIA_Q4J2_V42G_KW4N_1M31U6465337
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4QIS0Y00_K788_3BRR_G510_L26XY452725R
mov ecx, 0x5b5b90
call fcn.0050f680
push str.52176bc0_9efb_11e6_b25a_806d6172696f
mov ecx, 0x5b5b90
call fcn.0050f680
push str.52CUCWNL_RV4M_F7V1_28DU_48NL8UR48UKK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5460C4DF_B266_909E_CB58_E32B79832EB2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.59E9FDFA_FF3A_C50A_0DEC_EFDFCBB6B9D7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5S83G07S_40HO_36A0_PTAV_3RW23KEE0UQ4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5Y817507_GXY6_YGB0_4011_8R66E5M10X2V
mov ecx, 0x5b5b90
call fcn.0050f680
push str.60LWJPN6_HAF5_8351_3S3F_E318052376J8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67KLN5J0_4OPM_00WE_AAX5_74CC3A322132
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67KLN5J0_4OPM_00WE_AAX5_74CC2A322142
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67KLN5J0_4OPM_00WE_AAX5_77EF1D157322
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67KLN5J0_4OPM_00WE_AAX5_77EF1D187322
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67KLN5J0_4OPM_00WE_AAX5_77EF1D187563
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67KLN5J0_4OPM_01WE_AAX2_5657QCA554112
mov ecx, 0x5b5b90
call fcn.0050f680
push str.67KLN5J0_4OPM_01WE_AAX5_314CCA322142
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6R8T0DKK_OW3T_II16_4J86_IP2QEK6ORH87
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6U44VOD0_2POK_BGLB_6X6P_XUFJ7UA87FHX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.73CA3KJF_WV1I_E458_AS18_0G034V724685
mov ecx, 0x5b5b90
call fcn.0050f680
push str.76253HHC_XA2V_2RX2_2O03_OUBJOR754AC4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.768824VH_X2YV_PEW4_5V2T_7226O40B7R8C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.77566C2A_2987_44BC_AC81_A02D19EE271B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.78X4TSHV_82K8_W836_HK6F_38O148T25H85
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7D74FEF0_4FB1_115E_BD3E_47843FF25DF9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7HJ46KW1_AK3F_7722_P1TE_68183U0F1516
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7T447Y33_X347_516Q_1PE1_7J55FWOT7Y30
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7XOS4W0K_H4LE_56X7_UJ07_L110BJ4GFYE8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.84A87371_0D86_8C76_BE0B_432F81964CC4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.84B0DIYX_PC63_6D34_570T_YW54Q1M2RH7A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.88ABC5C0_4FCB_11BB_AAX5_81CX1C635612
mov ecx, 0x5b5b90
call fcn.0050f680
push str.88B2E5C0_5FCB_11QQ_BAX5_114016608589
mov ecx, 0x5b5b90
call fcn.0050f680
push str.88DU4BYL_1DR2_8N6T_HR32_NS46F381DF71
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8HT13B43_63DE_V183_QH54_0467XV40676D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8LX76754_A107_LUW7_VNS0_8HXKYG820NV2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.97A8EC5C_1AFA_AFCC_EB69_B8AD0DAEFA9D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99BCD9C2_4FCB_11CF_AAX5_62CB1C636512
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99ESP9C2_4FCB_12CF_AAX5_62CB1C636512
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99ESP9C2_4FED_15CF_AAE5_62CB5F2X4512
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99NEW9C2_4FCB_11CF_AAX5_62CB1C636422
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9L6ME_5454E_4EDXE_4E7SQ_9KJHI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A0X00RT0_X1J4_5HI4_L3E5_8416NLL8PT2J
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A50E8AE8_2D54_33E8_FD1D_0BB572ABB353
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AC018590_FBBD_4789_A15B_FFBBBE6C8965
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B1R4X6Q6_38AJ_P6L0_Y740_01J2YA7AKCK3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B6CDEEF5_E0CB_D7F3_E21C_A9BEFE3EEBD3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BAFA36CD_D7AA_D365_C29D_8948F5DFFAC3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C0DADD7E_D3F1_430D_B735_39DC6033592C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C3CLHA3A_IDOS_I3G0_C15H_8QCS7848J8IY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C9E9A340_D1F1_11D0_821E_BIFROST999999
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CA1EDAAA_DD84_EABB_51AB_CEDCD3CDFC1B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CEA3DBFE_B27F_BA2B_D8A2_8C6F60FBBC65
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CFB3DFAD_DEAB_9CDB_FADA_AC0C1646D9CD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D155V620_5Q3U_10J4_6LXF_W04D38053O68
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E994FDE9_A9AC_AEEF_B960_A7DAFDB5DBDF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EDD6F758_FD06_690B_35E7_163B9CFF6C68
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F146C9B1_VMVQ_A9RC_NUFL_D0BA00B4E999
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F5CAC3FB_AB05_FFAF_526F_09BFCFF8DCAD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FABA5A78_8F30_57E8_6F46_0A6082ABA608
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FLR12C8M_LF2H_OG0P_PX1E_N0TRI513Y10X
mov ecx, 0x5b5b90
call fcn.0050f680
push str.G8448241_80YR_8VL8_2CPD_7WD2AP61UB6C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gNlHvcTl_X3Rf_glhX_zEHE_R7LhQcT46ee6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GNI81MVA_YV71_D470_SA22_UDB47UX3PFTX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GX60EGSI_L367_5322_U0VJ_7GN3T6FHVM1Q
mov ecx, 0x5b5b90
call fcn.0050f680
push str.H9I12RB03_AB_B70_7_11d2_9CBD_0O00FS7AH6_9E2121BHJLK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HE854WG3_B1N2_4XE5_EHGT_325584C83S2P
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HLI81XI5_7326_2136_72A1_7Q00EXP4HEDO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.I8877104_6125_5WU7_VAYG_S5K3CM2I1XV8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ILC0D6DW_314A_58FX_3U05_C35QOA66D730
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IHO6EE8L_C72H_O6W8_27WY_MY0F82P1D606
mov ecx, 0x5b5b90
call fcn.0050f680
push str.K44H6OHL_200J_PWVT_M5J4_C14D1GVC571B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KAJXPUE7_11XB_X2OI_02F2_J38Q8373S0KA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KN65MM8D_TUL7_267K_0N35_1530D4P0QI5D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.L81I5XW8_62XV_I8R8_I312_D644U843G2J6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.L83H3826_EWFQ_662A_O71P_0S41SU107HO7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.M20HPXH6_GP04_YLS1_0UXN_1D64X5UL087C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MB3JKSW_Y883_WE0K_IY6U_SL6N6I178
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MQ7E162C_G40B_POGC_BR10_W1R3U0M04M64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MV45186G_55AU_ATUI_F5RG_7823OV30G5Y8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NF0GNK6P_603L_S7QN_0X3Y_F014O2NRTL0T
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NZxM6bfj_spIf_MH7X_50xF_ntCi2xpPgWGa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.O7DVEO2L_73O2_OY7X_E75N_0A1T7HQD5228
mov ecx, 0x5b5b90
call fcn.0050f680
push str.O8QODRIK_01JL_ACF1_MM8G_01M70QSX5781
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OKF0668D_J82A_P015_27GR_6A6A55YE43IG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PP1R8EC4_SS36_O24O_V5UU_022373BBM7N6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QbUUmTWv_vB5o_PUu5_6nzJ_qFZqif61VYcq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QE2I3NMN_032K_7R2D_4FV5_EH7M33CTBGN5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QMEAJQA8_V0L4_T22O_X75T_42WM8N871D81
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QRXL2307_5B35_675J_J68H_Y0PLN1XQ71X8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.R10JDO5H_RFYO_54G7_4F3L_2O5T20US0217
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RTKC2426_HCV4_1850_U4H5_BTXTFTX8U43T
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RTXK60MB_AY45_U2IO_YM20_7B08A33VD826
mov ecx, 0x5b5b90
call fcn.0050f680
push str.S1YW3N6D_63QW_Q0JP_6OXC_I031YLN58GL4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SOQPsW4k_aPQI_LBk3_kwuj_TsDAJ31w9FDg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.T5TBB77L_4678_0MKC_421Q_14416031DYU6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TJ27PKG0_RIHF_LQ0T_6KE7_5EQVW0MHNHTY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TN38RH36_U670_03U7_57DE_24XMTWQBHGH1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TUM3A0PE_665R_CX5N_S142_77H00UYW6RC6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TVOM8E42_5063_3AOG_77R0_Y3EL6I40YA71
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TYT7LD40_CG11_13V6_8481_7682QSR8F062
mov ecx, 0x5b5b90
call fcn.0050f680
push str.U5O7C516_J5T3_1HR1_0HO2_H28I1B8M2K7R
mov ecx, 0x5b5b90
call fcn.0050f680
push str.U6T6418F_YO46_46OU_6PY7_57O48H2D71Y3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UJKCA56L_3028_7A1B_86NL_AWA3RHMI31NM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UL0J35EK_4812_5A22_5827_J02V07OJ0H4J
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UO81QN75_G2CM_0P2P_AQ05_HD01U737C3W5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UT405874_TD20_30Y3_YUGS_13T448MGRUC6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UzJxoivj_yZU1_QsYE_9Lom_t3O3kEFQJiRw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VA303SCO_3C07_FQ76_N7OM_4J45G013T3O2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.W34O146D_J3JE_N3C7_O0KX_1F6171W81L40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WOW783OM_11IX_FY15_50NB_373Q50R2XI5W
mov ecx, 0x5b5b90
call fcn.0050f680
push str.X61RJIY3_CH16_P7UH_7B18_TX37IUCV1LE0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.X9OBC5C0_4FCB_11CF_AAX5_81CX1C635612
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XDF4VV15_4OJS_8W34_VUK6_GNK7VRPFLU30
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Y479C6D0_OTRW_U5GH_S1EE_E0AC10B4E666
mov ecx, 0x5b5b90
call fcn.0050f680
push str.YTJ1VT05_1XNA_6Y6R_O15U_VDH5P5A1836Y
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6D55E99A_BFA6_4B5E_8096_EDE5EDA51779
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581cc0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.comine
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581cd0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581cf0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SSDPDiscovb
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c2255
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c231a
push 0x5b8dcc
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c2292
jmp 0x4c2248
push str.SoftwareMicrosoftActive_SetupInstalled_Components_
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4c2315
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.Eliminado___Installed_Components___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4c2248
push 0x5b78a4
push str._sClassesVirtualStoreMachineSoftwareMicrosoftActive_SetupInstalled_ComponentsFLR12C8M_LF2H_OG0P_PX1E_N0TRI513Y10X
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sClassesVirtualStoreMachineSoftwareMicrosoftActive_SetupInstalled_ComponentsBAFA36CD_D7AA_D365_C29D_8948F5DFFAC3
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov ecx, 0x5b5b90
call fcn.0050f5b0
push 0x581e5c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581e78
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581e90
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581eac
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581ec4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581ed8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581ee4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581ef8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f08
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f18
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f28
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f38
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f44
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f50
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f58
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f60
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f70
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f80
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581f94
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581fa4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581fac
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581fb8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581fcc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581fd4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581fe0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x581ff0
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c2519
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c2594
push 0x5b8dd0
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c2551
jmp 0x4c250a
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderStart_MenuPrograms_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
jmp 0x4c250a
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.04F414E9_E352_4BC3_963D_7BFE5A5F31A9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0878F049_D33E_45E0_A157_C36A6683CF25
mov ecx, 0x5b5b90
call fcn.0050f680
push str.09F1ADAC_76D8_4D0F_99A5_5C907DADB988
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0F222EC8_205D_463F_90C9_D7249B333F09
mov ecx, 0x5b5b90
call fcn.0050f680
push str.163A949D_2A1F_4B4C_AE46_83D0F59BE189
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1A26F07F_0D60_4835_91CF_1E1766A0EC56
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1D4DB7D2_6EC9_47A3_BD87_1E41684E07BB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1D6711C8_7154_40BB_8380_3DEA45B69CBF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.25365FF3_2746_4230_9DA7_163CCA318309
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3C5BA506_6C30_4738_9CED_797ACADEA8DC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3ECF916F_A5DE_4DD4_A142_B35A29DC2EDB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.42F2C9BA_614F_47C0_B3E3_ECFD34EED658
mov ecx, 0x5b5b90
call fcn.0050f680
push str.469C7080_8EC8_43A6_AD97_45848113743C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4B6015E7_3ABB_45DC_96B7_55A843751F28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.511F9316_771B_4953_A268_1C36DA667FE9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.590FFB84_6A29_4797_9C0E_B15DF2C4CDCB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6986A6CF_9D58_11D6_91C2_00E02964E8E3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6BEA1C48_1850_486C_8F58_C7354BA3165E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.74CD40EA_EF77_4BAD_808A_B5982DA73F20
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7AA32FC7_133B_4AE7_998E_CED0D9829B12
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7C559105_9ECF_42B8_B3F7_832E75EDD959
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7EC687F9_9EFB_4FA3_A5BA_197C3461448A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.82FC4503_8459_4239_9B85_0617BEAA950A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8C875948_9C60_4381_9248_0DF180542D53
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8FCDF9D9_A28B_480F_8C3D_581F119A8AB8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.91433D86_9F27_402C_B5E3_DEBDD122C339
mov ecx, 0x5b5b90
call fcn.0050f680
push str.97B79133_88F0_45F0_8D57_0F2EF27D9C66
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A1426AC5_8CE5_4A00_B71E_011D35709AC6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AF2E62B6_F9E1_4D4F_A10A_9DC8E6DCBCC0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B64F4A7C_97C9_11DA_8BDE_F66BAD1E3F3A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BB0578ED_E672_4697_9663_EC5A0460B949
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C660C559_903D_41A5_991B_ED7959096C35
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CB5D474E_A510_40A4_B5A4_838933BCBA64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CDCBE0F1_D13A_4F86_A963_3A272D3ABA7E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CE572474_335E_4CE4_9895_04D3009C29CB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D62B5127_8D03_4175_BA71_E0041595DA4B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.D7BF3304_138B_4DD5_86EE_491BB6A2286C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DB893839_10F0_4AF9_92FA_B23528F530AF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F72BC3F0_6C20_4793_9DDA_258589D8A907
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F919FBD3_A96B_4679_AF26_F551439BB5FD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FA1D6D8F_C6ED_4752_8512_A33283240130
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FBF65A16_C9AB_465E_AECE_D2D9D5AB5E60
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c282d
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c28f2
push 0x5b8dd4
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c286a
jmp 0x4c2820
push str.SoftwareMicrosoftCode_Store_DatabaseDistribution_Units_
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4c28ed
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.Eliminado___DPF___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4c2820
mov ecx, 0x5b5b90
call fcn.0050f5b0
push 0x58273c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.14D108C8_DD97_4b78_8B50_C981500ABB8F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1A00C40B_DA85_4aa3_A67F_582D9347EECD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1B0E7716_898E_48cc_9690_4E338E8DE1D3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5886A6DC_AAF4_45E9_979A_8E5E6DEE30E7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6A512BF7_EC78_4e8d_9841_6C02E8FA9838
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58282c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.79A765E1_C399_405B_85AF_466F52E918B0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.799A370D_5993_4887_9DF7_0A4756A77D00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8A0DCBDA_6E20_489C_9041_C1E8A0352E75
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8F9FBEB8_D216_4d6c_8D21_513157E09C0D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.99C91FC5_DB5B_4AA0_BB70_5D89C5A4DF96
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A55581DC_2CDB_4089_8878_71A080B22342
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A92DAB39_4E2C_4304_9AB6_BC44E68B55E2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BC3BBF86_E4EC_4412_9676_8355468B3B05
mov ecx, 0x5b5b90
call fcn.0050f680
push str.d08d9f98_1c78_4704_87e6_368b0023d831
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E50A80C0_AEAC_8BC4_E782_8682F34E1C33
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E7AFFF2A_1B57_49C7_BF6B_E5123394C970
mov ecx, 0x5b5b90
call fcn.0050f680
push str.eeb86aef_4a5d_4b75_9d74_f16d438fc286
mov ecx, 0x5b5b90
call fcn.0050f680
push str.F20239CB_33DC_4EC6_959E_73EDEA0FE4D7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FA1B727D_3970_4561_8AC6_AC8AA7DBA639
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582a84
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582a8c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2020SEARCHTB
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582aac
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582ab4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ActiveShopper
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582ac8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582ad0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AdwareAlert_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AdwareSheriff_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Alexa_Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582b14
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582b20
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582b2c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Antimalware_Doctor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AntiVirus_AntiSpyware_201
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582b68
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582b80
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AntiVirus_System_201
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582bb4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AproposClient
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582bd8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AskTBar_Uninstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Asterisk_Key
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582c10
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582c1c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BargainBuddy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bdeplayer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.blastofstitchss.zip
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582c50
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BlueScreen_W_rning
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BlueScreen_Warning
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582c88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Brickshooter_Egypt_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bridge
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Browser_Protection_Volume
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582cd0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582ce0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582cec
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582cfc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582d0c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582d14
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582d20
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ConnectionServices
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582d40
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582d4c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582d58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Contextual_Ads
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CToolbar_UNINSTALL
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582d88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DBTB00001.DBTB00001Deskbar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582db0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dealply
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582dc4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.delta
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Deewoo_Network_Manager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dlls_0.5.6
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582df8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DotComToolbarNLDotComToolbarNL
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582e28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DMVLite
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582e34
mov ecx, 0x5b5b90
call fcn.0050f680
push str.drop_spam
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582e50
mov ecx, 0x5b5b90
call fcn.0050f680
push str.e2g_Plugin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EliteBar_Internet_Explorer_Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ErrorSafe_Additional_Feature
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ERS_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EvidenceEraser_add_in
mov ecx, 0x5b5b90
call fcn.0050f680
push str.eXact_Search_Bar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.eXact_SearchBar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.facemoods
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FamilyKeyLogger
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f08
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f14
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f20
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f28
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f38
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f48
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f54
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f58
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582f60
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IE_AntiVirus
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IE_Custom_Tools
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IE_Safety_Features
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582fa0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582fb0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582fbc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Information_Center
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x582fdc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Installer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Connection_Update_and_HomeP_KB234087
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Explorer_Secure_Plug_in
mov ecx, 0x5b5b90
call fcn.0050f680
push str.internet_explorer_toolbar___dropspam
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583070
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Optimizer_Active_Alert
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_update
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5830c8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5830d0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ISTbarISTbar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5830e8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5830f0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Kapabout
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583108
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583114
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lifestyle_._dropspam
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LinkOptimizer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583148
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583160
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58316c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583178
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Malware_Destructor
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58319c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5831a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Media_Codec
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5831c4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5831dc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5831f4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583208
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583218
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583224
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MiNODLogin
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583244
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Monobanda___Herramienta_de_Monografias.com_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MonobandMonoband
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MS_AntiSpyware_2009_5.7
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5832ac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MultiMedia_Software
mov ecx, 0x5b5b90
call fcn.0050f680
push str.My_Global_Search_Uninstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.My_Search_Uninstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.My_Way_Speedbar_Uninstall
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyWaySearchAssistant
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyWebSearch_bar_Uninstall
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583348
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583354
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nCASE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Need2FindBar_Uninstall
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583378
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58337c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NewProduct_1.00
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583394
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58339c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5833a8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5833b0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OfferOptimizer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.onesoftperday_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5833e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OverSpy_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5833fc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58340c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PDefender
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PeenyBee
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583430
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58343c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583450
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58345c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PopupProduct
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583478
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583484
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583490
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58349c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.prnet
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5834b0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PuritySCAn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QuickBar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5834e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QuickSearch_Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RegQuick_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RelatedLinks
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Remote_Desktop_Access__VuuPC_
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583540
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58354c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RXToolBar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583568
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Safesearch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58357c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583584
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58358c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583594
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SBSoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SD_is1_Optimizer
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5835b8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5835bc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Search_Function
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5835e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Search_Guard_Plus_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Search_Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583620
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SearchAssistant_Uninstall
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58364c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583658
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Secure_Browsing
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Security_Messenger
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583688
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Shopping_Community
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ShoppingWizard
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ShowSearch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5836bc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5836c8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5836d8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5836e4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SoftwareUpdater
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583704
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583710
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spy_Sheriff
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583728
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583730
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583740
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spyrix_Free_Keylogger_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58376c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58377c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583790
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5837a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SSSInstaller
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5837b8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Surf_SideKick
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5837d0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SYP_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TBON
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TBSB07183.TBSB07183Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TelbarTelbar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583810
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58381c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ToolbarBestToolbarsToolbar.ToolbarBestToolbarsToolbarObjectIEToolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ToolbarBuscador_de_Arquitectura_Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TTOOL_UNINSTALL
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5838a8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5838b4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5838bc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UERS_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Uninstall___obs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Uninstall_obs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UninstallAltnetdm
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58391c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.untopr1150
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583930
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583940
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583954
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vision_Communicate
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583974
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WA6P_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58398c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583994
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58399c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WCPR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Web_Application
mov ecx, 0x5b5b90
call fcn.0050f680
push str.webHancer_Agent
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WebSearch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5839dc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.While_You_Surf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.whSurvey
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win_Sniffer_is1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583a14
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Safety_Alert
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583a40
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583a58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winds_24
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583a7c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583a98
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wmvmedialease_codec
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583ab8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583ac0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WsysControl
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583ad0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB00001.XBTB00001Barra_HispaVista
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB00001.XBTB00001Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB00885.XBTB00885Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB01232.XBTB01232Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB02891.XBTB02891Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB03748.XBTB03748Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB07618.XBTB07618Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583bb0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Yazzle1122Oin
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583bc8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583bd4
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c3a7e
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov ecx, 0x5b5b48
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c3ae3
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b48
call fcn.0050f5d0
push eax
mov ecx, 0x5b5b90
call fcn.0050f0c0
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x583be8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
jmp 0x4c3a6f
mov dword [0x5b84b8], 0
jmp 0x4c3afc
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c3bed
push 0x5b8dd8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c3b39
jmp 0x4c3aef
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionUninstall_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x583c38
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
jmp 0x4c3aef
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.666.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ecodec.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.helper.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MalwareWipe.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MalwareWipe.com.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MessengerSkinner.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spy_Quake2.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spy_Shield.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.spyaxe.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpyLocked_3.6.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spyware_Quake.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpywareQuake.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583d78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VenoM.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x583d94
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c3cf3
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c3d69
push 0x5b8ddc
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c3d2b
jmp 0x4c3ce4
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
jmp 0x4c3ce4
push 0x583dd8
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x583e00
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x583e08
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x583e14
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x583e2c
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x583e3c
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_Explorer
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Search
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SearchURL
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SearchSearchAssistant
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.MainSearch_Bar
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.MainSearch_Page
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x583ec0
push 0x583ecc
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMain
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.AutoSearch
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.BandRest
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.DisableScriptDebuggerIE
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SetHP
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.Window_Title
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMedia
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x583fa0
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerShellIconOverlayIdentifiersmsoerc2
push 0x80000002
call fcn.00402a6b
add esp, 8
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.006EE092_9658_4FD6_BD8E_A21A348E59F5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.014DB5FA_EAFB_4592_A95B_F44D3EE87FA9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.04BA3181_C231_4DD3_9435_5CE7623E9800
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0B4D26F6_61A8_4463_99DD_5F2FE0400FA6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.0D7562AE_8EF6_416D_A838_AB665251703A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1EA689D5_61F5_4654_9A46_2EF703429B48
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2023ECEC_E06A_4372_A1C7_0B49F9E0FFF0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.31090377_0740_419E_BEFC_A56E50500D5B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.33BB0A4E_99AF_4226_BDF6_49120163DE86
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3BD44F0E_0596_4008_AEE0_45D47E3A8F0E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.460C3D19_B3D4_4964_A550_77D263B0CCCB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.589B893E_773C_4941_88C2_0DCC718E621C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5906B407_37B8_4BBC_BD72_4B5D3B001F49
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5B4C3B43_49B6_42A7_A602_F7ACDCA0D409
mov ecx, 0x5b5b90
call fcn.0050f680
push str.77AA745B_F4F8_45DA_9B14_61D2D95054C8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.828B376B_F2F6_4778_928C_E29EC877535E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9BB47C17_9C68_4BB3_B188_DD9AF0FD2476
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9BB47C17_9C68_4BB3_B188_DD9AF0FD2503
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A33DB9FD_7A8A_496E_92D3_9CFCF9D9E1C9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BB74DE59_BC4C_4172_9AC4_73315F71CFFE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BB82DE59_BC4C_4172_9AC4_73315F71CFFE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BFFED5CA_8BDF_47CC_AED0_23F4E6D77732
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E733165D_CBCF_4FDA_883E_ADEF965B476C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EBD839AE_B08C_4FB7_859B_F54AF16C159F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EEE6C360_6118_11DC_9C72_001320C79847
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c40f6
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c42e9
push 0x5b8de0
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c4133
jmp 0x4c40e9
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerSearchScopes_s
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x584420
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
lea eax, [ebp - 0x12bc]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14d4], eax
mov ecx, dword [ebp - 0x14d4]
mov dword [ebp - 0x14d8], ecx
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x14d8]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12bc]
call sub.MFC42.DLL_CString::CString
push 0x58442c
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
lea ecx, [ebp - 0x12c0]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14dc], eax
mov edx, dword [ebp - 0x14dc]
mov dword [ebp - 0x14e0], edx
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x14e0]
push eax
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c0]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4c426b
mov edx, dword [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x414]
push eax
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.Eliminado_Proveedor_de_Busqueda:_n__s_______s____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes_s
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerSearchScopes_s
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
jmp 0x4c40e9
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerExtensionsBF69DF00_2734_477F_8257_27CD04F88779
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerExtensionsBF69DF00_4734_477F_8257_27CD04F88779
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.10954C80_4F0F_11D3_B17C_00C0DFE39736
mov ecx, 0x5b5b90
call fcn.0050f680
push str.10E42047_DEB9_4535_A118_B3F6EC39B807
mov ecx, 0x5b5b90
call fcn.0050f680
push str.120E090D_9136_4B78_8258_F0B44B4BD2AC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1AE2F26C_8E23_4930_A68D_9E681A764001
mov ecx, 0x5b5b90
call fcn.0050f680
push str.237AA178_C3BC_4F67_A8BB_D8BC14BA0B89
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3B8FB116_D358_48A3_A5C7_DB84F15CBB04
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3CC3D8FE_F0E0_4DD1_A69A_8C56BCC7BEBF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3CC3D8FE_F0E0_4DD1_A69A_8C56BCC7BEC0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6671A433_5C3D_463D_A7CF_5587F9B7E191
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6CA2A4DE_483E_456B_8634_6445460D7097
mov ecx, 0x5b5b90
call fcn.0050f680
push str.77FBF9B8_1D37_4FF2_9CED_192D8E3ABA6F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.92731A49_62CA_42FA_B405_B8169C032082
mov ecx, 0x5b5b90
call fcn.0050f680
push str.946B3E9E_E21A_49C8_9F63_900533FAFE14
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A26ABCF0_1C8F_46E7_A67C_0489DC21B9CC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.A6F74643_242A_A7A4_8DD5_AB40B9E25345
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B58926D6_CFB0_45D2_9C28_4B5A0F0368AE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B6E649FA_5461_40D7_AB4D_54FC3C8DB767
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BFA03761_5565_41B3_93D9_82B354C0A8EC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C5428486_50A0_4A02_9D20_520B59A9F9B2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C5428486_50A0_4A02_9D20_520B59A9F9B3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C95FE080_8F5D_11D2_A20B_00AA003C157A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CD67F990_D8E9_11D2_98FE_00C0F0318AFE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CDB280E8_BE43_4128_8A5A_3FCD094E2D88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.E77EDA01_3C56_4A96_8D08_02B42891C169
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c44ca
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c4607
push 0x5b8de4
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c4506
jmp 0x4c44bb
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x40c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerLowRegistryExtensionsCmdMapping
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerExtensionsCmdMapping
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x40c]
push ecx
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.SoftwareMicrosoftInternet_ExplorerExtensions_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
jmp 0x4c44bb
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str._rptls
mov ecx, 0x5b5b90
call fcn.0050f680
push str._22EIBA
mov ecx, 0x5b5b90
call fcn.0050f680
push str._6GGXHW
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GVBU8D
mov ecx, 0x5b5b90
call fcn.0050f680
push str._XJSVQK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.____Mutex____
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B8F7C665_C2AA_C0FB_DD4C_DD4C60C29858
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DFFEDBC9_CE01_45EF_B8C4_6B857FFA320B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EBF773E4_4D01_4702_89FB_EA505579514E
mov ecx, 0x5b5b90
call fcn.0050f680
push str.00ccda7f3c606af9e1181413ef821ac7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.100units_BE38NL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.10DIC_WRGB17
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584b4c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.180ax
mov ecx, 0x5b5b90
call fcn.0050f680
push str.180solutions
mov ecx, 0x5b5b90
call fcn.0050f680
push str.1877_spelzoyulk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.200UNITS_NF0EPF
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584b88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.2df5a8bc879d2561a05f8b28eca22382
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584bb4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.3721
mov ecx, 0x5b5b90
call fcn.0050f680
push str.44c5y5ec44wtd4yetdtwd4tert_0BC9MC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4719c943e138bd82295328a938b81bbe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.4cba2f29113218cda6ed3807d1a5fd9d
mov ecx, 0x5b5b90
call fcn.0050f680
push str.52_32_42_54_34_E6F2PD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.54xmz2NgW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5acea57b529db7e6c94c669bcc14bf61
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5E59008BE18212A8924BDB25D5126DD2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.5T19I3B27A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.64_this_shimSkip
mov ecx, 0x5b5b90
call fcn.0050f680
push str.66fb4d21281ff3a2eb1082164b0bc196
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6c1567cde2639e7f2e31584fc3be4bb7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6E6AA9EAC0A4AA3478CB22D63195BC87
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6Y5LgRTQ2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.7G21B2J74A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.884E079B2F78C10334A79B210E9EA2B7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.8DiQ0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.9416a517bdcd8521_8QM7X6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aaaaaaaddddddsdfffffjjjj_6AYGTB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aAQZ6qhr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.abc_XMP557
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ac40286eaba111f8c6c7291a06915e70
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584ddc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ActivationManager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ActivShopper
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584e08
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adobe_Flash_XPM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AdRoarPlugin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Adtomi
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584e38
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584e3c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584e4c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584e64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AESxWin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Agence_Exclusive
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aiasfacoafiasksf
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584ea0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Allberst
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584eb8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.almojrem_UP1V46
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Altnet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Android5
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584ee8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Antimalware_Doctor_Inc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584f0c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584f20
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584f3c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584f54
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584f70
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Antivirus
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584f94
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AntivirusGold
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584fb4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.apc_JWGZIQ
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584fd4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x584fd8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Appsync_TYGH55
mov ecx, 0x5b5b90
call fcn.0050f680
push str.april2021_WUMGUE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Apropos
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Araf15
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585018
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585020
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AskSBar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585034
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58503c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ASProtect
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585054
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AutoLoader
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Avenue_Media
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58507c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AvScan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AvSoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.avsuite
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AZESearchCo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B5MSoft
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5850ac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.backup_QTHD8S
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BackWeb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bargains
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bazz_RTSMNZ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bbl1r3r_J64C7O
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BC_Clients
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Beermat_Software
mov ecx, 0x5b5b90
call fcn.0050f680
push str.besdtoui_YIQ76J
mov ecx, 0x5b5b90
call fcn.0050f680
push str.besdtovedrt_KBMR1W
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bestuooui_JA29UZ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bestuoouikkk_JSY0R3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bestuoouikkk_KURDE5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bgy_hyt_juj_BISZGM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bifrost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BlackLivesMatter
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5851a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.boly_8JNIZA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.boly_JG8TGB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Bookedspace
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bots_Priv3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.botrop_CBYM4L
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5851f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Brilliant_Digital_Entertainment
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585220
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Buran_V
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Buscador_de_Arquitectura_Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.bvoupe_KJA105
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58526c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.c48e7c7b9c28672ef5b41e026d8ab2fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.c62a5baf806863ffa89862e7aeb2573f
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CAISTES
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Car_90CQK6
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5852d0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5852dc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cazado
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cel3br_GI95N0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cera9og4_C01R1Y
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cerberus
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ceres
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585328
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58532c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ClassesPrbjdalyvr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ClassesSoftwarePrbjdalyvr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ClickSpring
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585378
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Client.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58538c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585398
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cn911
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cn999
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Coffin_Of_Evil
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Coffin_Of_Evil_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Comet_Systems
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5853e4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.comres_ISTZOF
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585400
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58540c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585418
mov ecx, 0x5b5b90
call fcn.0050f680
push str.corel
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58542c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cppguru
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cpush
mov ecx, 0x5b5b90
call fcn.0050f680
push str.crackmen
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58544c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CryptoSecure
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CToolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cuud
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CvaYhtj_O4TVO8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cvxfdgsd_92QGKY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cydoor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Cydoor_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5854b8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.d419bb2ccbf769cb7228a22985b38c3c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5854e8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.date_U2FO93
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dates_9BYUCU
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585510
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DBTB00001
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585520
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DC3_FEXEC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dddfrankk_A7CI4X
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58554c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585554
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Default_Tab
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58556c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585578
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585588
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585590
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Derrick_9U5L31
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dfg6Yhj7bnKoPhgcXdtiOlKjhab9MeR5GDfaErty_0PoK_EQWUOW
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5855e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Director
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Displaysettings_VA8KEO
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585618
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58561c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DotComToolbarNL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DownloadAdmin
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58564c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.drelkge789AEF5
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58566c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dsfjnkrjofjkn33r_862BUI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Duofu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DuoMini
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DuoModel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DuoR
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5856b4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DWiew
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dynamic_Toolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.e_zshopper
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EchoRm_LRL5TG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.edfcxcsza_JJ2BTM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.edfcxcsza_JRI1AB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EF862871053D629497125712961B24FD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Effective_i
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EGDHTML
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Elitum
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Enconfidence
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585764
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Enigma_Protector
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EnvoloAutoUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EoRezo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EpicNet_Inc.
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5857ac
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5857bc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.esutscbvncjdkgi_HIYI7G
mov ecx, 0x5b5b90
call fcn.0050f680
push str.EWEKA1_BMH4IW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ewrew
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ex_data
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585800
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Explorer_I7VQMD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ExtSecurityCenter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ezLife
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585834
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Falcon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fastchicdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FBSearch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585868
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fddskhjvcnkmlrf_60PZ8U
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fedeef_M0D23B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fedtuicv_XU64WF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FENX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FF1D6BF5CB79
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fg4wer4s5trgfqewdc_WR9LLO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fghjcvbn_UURPOS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fgjjvjstdsgsjbcbjshs_1NGO41
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fgjjvjstdsgsjbcbjshs_9GQXDQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fgjjvjstdsgsjbcbjshsjfkfjfkfjfhfhdjdjdbshsbg_CJH0SQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fgjjvjstdsgsjbcbjshsjfkfjfkfjfhfhdjdjdbshsbgjh_OX7P8W
mov ecx, 0x5b5b90
call fcn.0050f680
push str.fiat_6YKHAF
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585998
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58599c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FirefoxUpdate.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.firefoxx_X6UNRD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FJgzrRMYFeZP
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5859d4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FocusInteractive
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5859f4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585a04
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585a18
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585a28
mov ecx, 0x5b5b90
call fcn.0050f680
push str.freesofttoday
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585a48
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FRT_WO543V
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585a64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FTapp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fullz_2016
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Fun_Web_Products
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585a90
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585aa0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585aa8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GAOV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GatescriptGeocities.com_gatescript
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GatescriptRun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Gator.com
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585b00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GCleaner
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Genesis
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gfhdfthvgcdfsgdfgsds_IIWZ4F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gfhdfthvgcdfsgdfgsds_QBM2I8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gfhdfthvgcdfsgdfgsds_RJHBZ2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gfjhgfvgtycvgh_8YY9VX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GFvbj_95CWLI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ggjfvjfvtgyjfvtgytdrcjgxdxhfg_6MCJN8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ggnative_5S623V
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ggnative_Q7Q2LG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ggnet_CUQONS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ggnetdelay_V4GCTL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ghshdfjsdfjsfdj
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ghv6fv_S80100
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GIANTCompany
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GitForWindows
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585c48
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GloboBarCo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gmx_6LWOTC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.good_C8SRY6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GoogleAppUpdate_9W8EQV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Googlesss
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gpooe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gqhwjekrltlu_TOU33Q
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585cbc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585cc8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gsgjdwgwjhjsasdscdsc_Z5PU8H
mov ecx, 0x5b5b90
call fcn.0050f680
push str.gtrhheyjngbretbb_5AFYYK
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585d00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hack
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hack_Server
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585d18
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HBTV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HFGFGfgHHKGKHGFGlklGHFHHRD_T170XJ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hfjfhdjdjdjssj_6X5NF1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hgdtryfhfhf_V1FOWO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HGFDFSFgfgFHD_1YT5NS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HGFGHgfdfyGHRthuhfddkHGFHGH_P9GH19
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HGGHhgfygERETRfhGKKHhggGHGH_AI5MND
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HGhhkjggYhjhyTghGf_ICIAPK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hhfkdhetdpppydcadejeyrygoiytirolppkk_NTUXHW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hhfkdhetdydgyiuyeurejeyrygoiytirolppkk_G5Y7V9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hhfkdhetdydgyiuyeurejeyrygoiytirolppkk_QUICA7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hjtfjytfcyhnghncghc_O9CPRJ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hjtfjytfcyhnghncghc_VX0P5D
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585eb8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HPLKVPJH_8DDH62
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HSJDHAFGS_9EV08K
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HTYGUHHJGYtgyhGHGHdds_0AKWWE
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585f04
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585f0c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.idle_PJ2M1L
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iDonate
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585f24
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iefeatures
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IExplore
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ihpmserver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iiwr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Imposter
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585f68
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585f78
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585f84
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585f90
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585f9c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585fa4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IntexusDial
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iosl_ajdl_adka_HUG780
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IpWins
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IS2010
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iSearch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x585ffc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586000
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586008
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iuyhg_CNQUL6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iuyhg_XOY14N
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iuytfdcuytf_OV62Q3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.iwqggaa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.java_TYXODO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.java1_3C0HZ3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Javaw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jhgfiuyt_QMLKNN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.JOHANNNNNNNNNNN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.juisel_SA1L7H
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5860a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kbkguyub_28XZUN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KBS1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kcgyuf_YM1QE9
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5860d4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.keys_data
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kgkjhgk_QOASGT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.khruioprs_T021C4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586110
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KJBHvgcfr_8F2D0T
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kkjhggtfddffbfdfghhggfdd_PPLB8N
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KMiNT21
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Krypton
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kukkokkkdjpppydcadejeyrygoiytirolppkk_ZBJORV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kul_ATJTE2
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58619c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LabelCommand
mov ecx, 0x5b5b90
call fcn.0050f680
push str.larrystreeet_yahoo.com
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LEO0WTUNO7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.leufoldi_4C32LO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.leurtcver_O1L01H
mov ecx, 0x5b5b90
call fcn.0050f680
push str.leurtcverbve_V3JFEJ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Licenses
mov ecx, 0x5b5b90
call fcn.0050f680
push str.livesvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lluiiidddppydcadejeyrygoiytirolppkk_W6Q6HN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LoaderCo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LocalNRD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LockBit
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LogonUI_UAT1ZF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Loki
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lollipop
mov ecx, 0x5b5b90
call fcn.0050f680
push str.londons_M1RJCW
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5862a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lsretyfeuo_M8J9WQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lu9c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lu10
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5862dc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.lversyt_ANNZB8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5862f8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Macromedia
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MagicSearchCo
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586328
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Malware_Destructor_Inc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586350
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58635c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Marcy_QS6KPF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Maria_Jose
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Maskcafgscas_K0OZUM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mata
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5863a4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Maxthon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MAY_BUILD_6F82VK
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5863cc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Media_Access
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Media_Pass
mov ecx, 0x5b5b90
call fcn.0050f680
push str.medi_re4vgt_R8LRUI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.meetingzoom_X4270N
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586414
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586428
mov ecx, 0x5b5b90
call fcn.0050f680
push str.microservices_70PSFH
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft09a92dad
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft386400c0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft9869c80f
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftAIVCZ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_aldd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_affltid
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_aoprndtws
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftBind
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftBy
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5864ec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftc81a337c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftCLN5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftcontim
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftDataDisp32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftDataDrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftdcads
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftDInf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftDsNiu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftDomainService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftDownloadManager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftdrsmartload
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftdrsmartload2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftdslcnnct
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftFifClInf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftFRD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftgg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftHook1.0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftInetData
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftInstkeyAF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftInternet_ExplorerExt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftInternet_ExplorerNew_Windows
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftIProxyProvider
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftjn_tr_2a5000d5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftjn_tr_8a5dc81a
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftjn_tr_da2e3369
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftlifiroja
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftLST
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftlw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftMDM_Data
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftMicrosoft_Alerter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftMS_Juan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftMS_Track_System
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftMSNSmartTags
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftMSSMGR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftNBFC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftNbInf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftNvchost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_nw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftPDefender
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftQOBP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftRasap2K
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftRASModule
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_rdfa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_rnpxl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftRuwak
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftSharedClickFlag
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftShipUp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftSideFind
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftSoftware_Notifier
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_style2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftVideoExtensions
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftVideoPlugin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftVSPlugin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftWindows_SA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftWindowsCurrentVersionFayfa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftWindowsCurrentVersionPoliciesAMeOpt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftWindowsyaseyige
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftWinis
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftxeroxw
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftxyduc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoftyaseyige
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Minisoft
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586a54
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mmnbgcxsassdgghocbcjvdjd_IEFH7T
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586a7c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586a88
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586a9c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Monoband
mov ecx, 0x5b5b90
call fcn.0050f680
push str.morethan_CJ2X2C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.morp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Movies_IG7UZ0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MozillaPlugins_ei.TelevisionFanatic.com_Plugin
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586b14
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msbb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSShell32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSView
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MTC_MTC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MxTarget
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586b48
mov ecx, 0x5b5b90
call fcn.0050f680
push str.myhdudhdmmderfff_0RK6ZO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mysoftware_XULZH6
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586b88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyWaySA
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586b98
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NavExcel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NavExcel_Ltd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NaviSearch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586bcc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nbncgdjgdbhjguhwj_RMCFYT
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586bec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NEC_Computers_International
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Need2Find
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netdetect
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586c24
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NetWire
mov ecx, 0x5b5b90
call fcn.0050f680
push str.New......
mov ecx, 0x5b5b90
call fcn.0050f680
push str.New.net
mov ecx, 0x5b5b90
call fcn.0050f680
push str.newpush
mov ecx, 0x5b5b90
call fcn.0050f680
push str.niben_24DMPS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NirSoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nisrine_1991_8GKHV9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nokia4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NordBull
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586c94
mov ecx, 0x5b5b90
call fcn.0050f680
push str.notepad_6GKL40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Notepad2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.notify
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nTKCe2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NUEVO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NvidiaConsole_TNC8HN
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586ce8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OCTBUILD_YLFT99
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586d04
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586d0c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586d14
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Office_P2UMIQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.oijbhy_CNFGCD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.oiuhyg_6ODD8G
mov ecx, 0x5b5b90
call fcn.0050f680
push str.oiuhyg_WQTE4W
mov ecx, 0x5b5b90
call fcn.0050f680
push str.okokok
mov ecx, 0x5b5b90
call fcn.0050f680
push str.onedrivemicrosoftwindowsnhyo9p8oiujedas_6LCW6B
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586d98
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586da8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Online
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Online_Add_on
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ophjgkjfmv_8RQED1
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586de4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Otsr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.owerri_D01D9O
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586e00
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586e10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pastananiceforwhat_OMFBDS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pc_Profile_Z92OYH
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586e4c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pdf_7NJKEB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PECarlin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Perezzz_Software
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586e90
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586ea4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PgccAgent
mov ecx, 0x5b5b90
call fcn.0050f680
push str.pidron_PXIKI2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pinnaclee
mov ecx, 0x5b5b90
call fcn.0050f680
push str.piohhghgvcjjghggjbcbjshsjfkfjfkfjfhfhdjdjdbshsbgjh_YJ34R0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PJ_Naughter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PoliciesAvenue_Media
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PostMaster
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PostMasterA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Poussin
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586f58
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PowerScan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ppnet_2NO28I
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586f80
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Prbjdalyvr
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586f98
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Prime_1AAPO9
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PrimeSoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Protection_Tools
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586fd4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586fe0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x586fe4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Pynix
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QtProject
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587004
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QUICKBAR
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587020
mov ecx, 0x5b5b90
call fcn.0050f680
push str.qXbVmAcGUaGxy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rabbit
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rafaello_O8XZF0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587054
mov ecx, 0x5b5b90
call fcn.0050f680
push str.razorsoso_K5DGEB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rbta
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587078
mov ecx, 0x5b5b90
call fcn.0050f680
push str.recfg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RegGS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RegistryQuick
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5870a4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5870b0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rem1_N83VQQ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rem92_P9KLDM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Remmcosi_E1GRSB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.remmyboy_RDHS4O
mov ecx, 0x5b5b90
call fcn.0050f680
push str.remote
mov ecx, 0x5b5b90
call fcn.0050f680
push str.remoteaccess_K0BEK4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.renovated_5QJ5BV
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587130
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Reum
mov ecx, 0x5b5b90
call fcn.0050f680
push str.revsr_bwssxphqkv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rgvmbsa_8TUJF3
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587168
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587178
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rjrtttrtyu_1W69NX
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rjyuio_MWHXDV
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rmcau1milol2_FPUZIS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RmcDuck_6IVRRT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RmcsPower_SYFR8B
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rmcw_KMC20U
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rokspslaahdhyebsbaahuyddjsjshdvags_5XELRW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RooGoo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RootEntry_NHOWG7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rrftf235___CWHCHK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RRRRRRRRRRR_O28YMP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RSASec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rtuiop_SB1R3F
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Rubt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rufustryewar_BN81U7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RunB
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RunC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RunD
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5872a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RW5JETRB76K6K_0EWYKR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RX_ToolBar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RZDVL2F27W
mov ecx, 0x5b5b90
call fcn.0050f680
push str.s2s5e3e3z5d5f4e5z_804WUR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.saap
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SafeSearch
mov ecx, 0x5b5b90
call fcn.0050f680
push str.saie
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sais
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Salus
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Saristar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sawret_M5FX7N
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sbmc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Screensaver.comRelevant_Knowledge
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587364
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587378
mov ecx, 0x5b5b90
call fcn.0050f680
push str.scvhost.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SE2010
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Search_Assistant
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5873a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Search_Toolbar_Corp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.search_exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SearchToolbar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5873e8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5873f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Security_Tools
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587414
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SerG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Server
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Setup
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sevsabbw_IH2O2T
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sgdhdjdgsgsu_N2NW89
mov ecx, 0x5b5b90
call fcn.0050f680
push str.shf435sag_TEXJD0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Shiesty_ECMYAP
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Shiesty_GI88AX
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587488
mov ecx, 0x5b5b90
call fcn.0050f680
push str.shwlwook
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SideFind
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sijhfgwjfk_9YXMD5
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sijhfgwjfk_A8V9VC
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5874d8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5874e0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5874f0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Softimer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Softomate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Softwrap
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587524
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpaceInvaders_OpenGL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpeedRunner
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587554
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sponsoradulto2
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587568
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587570
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587580
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Spyrix
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587598
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpyShield
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5875b0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5875c0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5875d4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5875e4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sql_1PRD1U
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sqlroot
mov ecx, 0x5b5b90
call fcn.0050f680
push str.STIEBar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587604
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587608
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ssssssssssssssssssssssa_VBDY16
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587630
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SupDp
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587640
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58764c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.supWindowsMangerProtect
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SurfSideKick2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SurfSideKick3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sysinternals
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sysisoft
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5876a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Process
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Soap
mov ecx, 0x5b5b90
call fcn.0050f680
push str.system32_AW6YV1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System32_64_C7LTOT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sistemanet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.syetem_8CVL3M
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SystemCore_773B7694
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systemk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.systems_AMVXWJ
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SysWebTelecom
mov ecx, 0x5b5b90
call fcn.0050f680
push str.taskmgrs_6NA7RO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tbon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tbro
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58776c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tcpudp
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58777c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TDSS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TeamViewer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TektonIT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Telbar
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5877a8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tencent
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5877c4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tldctl2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TMKSoft
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5877d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TONSCLOSETITLEBalm
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5877f8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Trafficjam
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TraTra_TG7K3D
mov ecx, 0x5b5b90
call fcn.0050f680
push str.trio
mov ecx, 0x5b5b90
call fcn.0050f680
push str.true_meta_EN2Y0Z
mov ecx, 0x5b5b90
call fcn.0050f680
push str.trueimg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Trust_Cleaner
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TrustIn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TrustIn_Bar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tukero_X_Team
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TurboDownload
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tutorials
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TutoTag
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Twaintec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.U36VRSFLG6
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ubpe
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5878b8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.uibuiyfuvytdfytfyuf_7DVX3T
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Umbrella
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Universal
mov ecx, 0x5b5b90
call fcn.0050f680
push str.unker
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5878fc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.update_8H6N2A
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Updates_NESLEV
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587924
mov ecx, 0x5b5b90
call fcn.0050f680
push str.uytrrtyu_NJTBCR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VB_and_VBA_Program_SettingsMicrozoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vendorxml
mov ecx, 0x5b5b90
call fcn.0050f680
push str.verguyio_MSL8QI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vidmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VIRICO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Virtuoza
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5879a0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5879b4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5879c0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5879c8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VolmgrmntHome
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vTask
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vwesrtferop_XQVETP
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5879fc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587a08
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587a10
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587a18
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wealth_n_blessings_00ZEU8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587a40
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587a4c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WhenU
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WhenUSave
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WildMedia
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win_Album
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587a84
mov ecx, 0x5b5b90
call fcn.0050f680
push str.win_9pivys
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587a9c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinAFCR
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587aac
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windef_KLHHCK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windowgqwuwed12ss_YFKUV3
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587af0
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587b00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsDefe_MFE6SN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsDefenderNotification.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsLive
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587b54
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587b6c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587b84
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinNTData
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winsapp_RI4O39
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587bb0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winsrar_GW8ZTG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wintaskhost_B7UON3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wintaskhost_LKIJYF
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587bf4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinTouch
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587c0c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winupd_v381_XLOJM7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.witircl
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587c30
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wolf_13XPAC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.word_YX6SFG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.workhole_2IQGXB
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587c60
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WS9E3IQBKY
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wsdeeqd_JHHA9X
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WSoft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB00001
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB00560
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB00885
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB01232
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB02891
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB03748
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XBTB07618
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xcdasweghfgfhtd_3QH3R0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XGgA6Wbi
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587d00
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587d10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XOFTMANREM_P4HWSA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xosftmn_W5WRJ1
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XP_SecurityCenter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.XtremeRAT
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587d68
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xxxsys
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587d78
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ydll_LKWYA7
mov ecx, 0x5b5b90
call fcn.0050f680
push str.YourSiteBar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ytdrfghcfdgv_KV7D88
mov ecx, 0x5b5b90
call fcn.0050f680
push str.yuhgfd_9Z85LD
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587dbc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zango
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zentom_System_Guard_Inc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zeppelin
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zugo
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x587dfc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ZYT_UDE15N
mov ecx, 0x5b5b90
call fcn.0050f680
push str.zzzsys
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c77f8
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b48
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c785e
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b48
call fcn.0050f5d0
push eax
mov ecx, 0x5b5b90
call fcn.0050f0c0
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x587e1c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
jmp 0x4c77eb
push 0x5b78a4
push 0x587e30
lea ecx, [ebp - 0x81c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0xa30]
push edx
push 0x20119
push 0
lea eax, [ebp - 0x81c]
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c7c84
mov dword [ebp - 0xa24], 0
push 0x200
lea ecx, [ebp - 0x61c]
push ecx
mov edx, dword [ebp - 0xa24]
mov dword [ebp - 0x14e4], edx
mov eax, dword [ebp - 0x14e4]
push eax
mov ecx, dword [ebp - 0xa30]
push ecx
mov edx, dword [ebp - 0xa24]
add edx, 1
mov dword [ebp - 0xa24], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4c78ee
jmp 0x4c7c77
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0xa1c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0xa1c]
push edx
call fcn.00401fca
add esp, 4
push str.12345ME_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.12345MEE_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.12345MEEE_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.APPSYNC_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.BACKUP_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.BRABUS_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.2022_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.CHORNE_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.CHROME_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.COMREX_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.CVXDSAXZCAS_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.CVXYTTYDFSGBGHFGFHTD_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.DASHBOARD_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.DAXVXDSAXZCAS_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.FILES_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.GALLERY_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.GGFJHGFVGTYCVGHFDF_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.GOLD_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.GSGJDWG_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.JD1985_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.MUSIC_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.NCUOA_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.NOTEPADS_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.PEACE_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.REMCOS_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.REMCOS
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.REMMY_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.RMC_
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.VD_VFD_DF_
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c7c61
push str.VKL_
lea edx, [ebp - 0xa1c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4c7c72
lea eax, [ebp - 0x61c]
push eax
mov ecx, 0x5b5b90
call fcn.0050f680
jmp 0x4c78aa
mov ecx, dword [ebp - 0xa30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5b84b8], 0
jmp 0x4c7c9f
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c7d8f
push 0x5b8de8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c7cdb
jmp 0x4c7c90
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x5b78a4
push 0x587f84
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.Software_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.SoftwareWow6432Node_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
jmp 0x4c7c90
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str._aGbPlugin
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbIEHAbn
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbIEHBsb
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbPluginAbn
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbPluginAbr
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbPluginBb
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbPluginCef
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbPluginIsg
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbPluginScd
mov ecx, 0x5b5b90
call fcn.0050f680
push str._GbPluginUni
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ANTIWAT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ANTIWPA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CBSSREG
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cfgmngr32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.clbcatex
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CRYPT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cryptnet32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.csbdll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.CTVISIO
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DIMSNTFY32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.eunlock
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FSMGMT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GOOTKIT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.h618
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kbupdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mdhcp32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5880dc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5880e8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Msctl32.dll
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Notifyc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.piolock
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58810c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58811c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RESET5C
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RGADTM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rpcc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SAFE_XP
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588150
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588158
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SYSFLDR
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tcpR32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UPDATENF
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WINCTRL32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winminix
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WINNT32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WINNT64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WINOAO32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WINOUD32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winup2date
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WLCTRL32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5881d4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5881dc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.zsydll
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c80cf
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c8194
push 0x5b8dec
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c810c
jmp 0x4c80c0
push 0x5881ec
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4c818f
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.Key_Eliminada__WinLogonNotify_s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4c80c0
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.29C400A3_2669_43D2_A1F1_0D0DB9453F5F
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588278
mov ecx, 0x5b5b90
call fcn.0050f680
push str.453543
mov ecx, 0x5b5b90
call fcn.0050f680
push str.53543
mov ecx, 0x5b5b90
call fcn.0050f680
push str.542453
mov ecx, 0x5b5b90
call fcn.0050f680
push str.57252
mov ecx, 0x5b5b90
call fcn.0050f680
push str.6to4
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5882ac
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5882b8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5882c4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.918712
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5882d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Abcdef
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Abcdef_ewrewrw_Qrs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Abcdef_wewewno_Qrs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Abcdefs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.abengine
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588328
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AdobeFlashPlayerHash
mov ecx, 0x5b5b90
call fcn.0050f680
push str.afisicx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AFSEGTGF_Windows_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58836c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AMService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AntiPol
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Antivirus32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588394
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Application_Layre_Gateway_Saervice
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Application_Policy_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Application_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.appveif
mov ecx, 0x5b5b90
call fcn.0050f680
push str.asdas_Dsck_test_My_Ja_4.4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ASecurity32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ASKService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ASKUpgrade
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aspnet_statespiq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.aspnet_statesqlc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.audiodcom
mov ecx, 0x5b5b90
call fcn.0050f680
push str.AudioHD
mov ecx, 0x5b5b90
call fcn.0050f680
push str.B5TService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BasicServe_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.batexxadvl32
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5884b0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Boonty_Games
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BrowserDefendert
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5884e0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BugreportW
mov ecx, 0x5b5b90
call fcn.0050f680
push str.BVDPSS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cake_bake
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588510
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cegushHelpersrv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588530
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588534
mov ecx, 0x5b5b90
call fcn.0050f680
push str.cmdService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.COM_Component_Service__COMCSVC_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.COM_System_Service__COMSS_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.configFont
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588598
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5885a0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.darkness
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DatamngrCoordinator
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dazsks_gmeakjwxo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dealplylive
mov ecx, 0x5b5b90
call fcn.0050f680
push str.dealplylivem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.debug32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DefaultTabUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Defghi
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DhcpSrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DirectX_jrq
mov ecx, 0x5b5b90
call fcn.0050f680
push str.disc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Dnscache32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DocFilePropertray
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DomainService
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58866c
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588678
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588680
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588688
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ehSchedaa
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ehSchedbr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ersd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FOPN
mov ecx, 0x5b5b90
call fcn.0050f680
push str.foundation
mov ecx, 0x5b5b90
call fcn.0050f680
push str.FWSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GAOPDXSERV.SYS
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5886d8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GbpSv
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5886ec
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GenesisMonitor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ggbugreport
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ghijkl_Nopqrstu_Wxy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WaaSMedicSbr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ghijkl_werwerweru_Wxy
mov ecx, 0x5b5b90
call fcn.0050f680
push str.globalUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.globalUpdatem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Google_Online_Services
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GoogleUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.GoogleupOS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HddSmart
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hide_evr2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Hooking
mov ecx, 0x5b5b90
call fcn.0050f680
push str.hookmgr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Host_de_dispositivo_Plug_and_Play_universal_Client
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Host_Generic_Process
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IBUpdaterService
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588824
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588834
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ihpmServer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IHProtect_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IhPul
mov ecx, 0x5b5b90
call fcn.0050f680
push str.InjectorService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.intelrp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Internet_Enhancer_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ioppqr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IPSECS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.IWjuOboC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.JIEoowHs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Jklmno
mov ecx, 0x5b5b90
call fcn.0050f680
push str.jzostlem
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kernelx86
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Key_Symbols_Notifier
mov ecx, 0x5b5b90
call fcn.0050f680
push str.kprof
mov ecx, 0x5b5b90
call fcn.0050f680
push str.KtmRm_Encrypting_Support
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LanManager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LaseityAdale
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ldrsvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.LnnHosts
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588958
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mabidwe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mchInjDrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mfreedft
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Micorsoft_Windows_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_authenticate_service__MsaSvc_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_ASPI_Manager__aspi113210_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_IE_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_IEUpdater2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Inet_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_P2P_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_SQL_Serverai
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Microsoft_Update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MicrosoftNET
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mmxf32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mmxf64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Mozillacorp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MRxCls
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MRxNet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msncache
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSUNatService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MsNet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.mssecsvc2.0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MSSysInterv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.msupdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.MyWebSearchService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ndisprot
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nethost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netpadserv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.netprofimg
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NetPT
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NetTcpIpFilter
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Network_DDE_Connections__NETDDEC_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Network_Adapter_Events
mov ecx, 0x5b5b90
call fcn.0050f680
push str.new_drv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nmclogservice
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Nopqrs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.noytcyr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.nprrstu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NsCloud
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NsDlRK250
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NsPsDk00
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NsPsDk01
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NsPsDk02
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NsPsDk03
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NsPsDk04
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ntldr.sys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NvUpdService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NvUpdSrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Oddysee
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OfferBox_update_service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Olacarita_update
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Olacarita_update_m
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OneStep_Search_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.OpenVPNService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PassWidget
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588cb0
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PenWesController
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PerfFont
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588cdc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.poof
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588ce8
mov ecx, 0x5b5b90
call fcn.0050f680
push str.president_kbr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.PrivoxyService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ProWinServer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.QuestService_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RdnaoFlSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588d4c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.read
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588d5c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RemoteStorage
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rfdkernl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.rgadta
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RioDrvs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.roytctm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.runtime
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Ruwak
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SAntivirusSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588dc4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.securentm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SensrCfigs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ServerNabs4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SeWini32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SiteServerService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SiteClientService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sndu32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sndu64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SorawardanagckmanagerSrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.soxpeca
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SQLAGENT_MSSQL_SQLIOSIMSA
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SQLntService
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588e84
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SrvAd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sscan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SSFK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SSHNAS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sslx32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sslx64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.StateftpService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.StdService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Stormser
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Stuvwx
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Stuvwx_Aberer_Jkl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sukoku_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SuperBackupMan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SuperProServer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SuperPro_Server
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x588f40
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SvcHost_Service_Host
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SvcProc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.svhost.exe
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Syscontents
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysdrv32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.sysguard
mov ecx, 0x5b5b90
call fcn.0050f680
push str.syshost32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Syslogon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sysmanger32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sysmangwers32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Sysmasngwers32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Information_N314
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Information_N321
mov ecx, 0x5b5b90
call fcn.0050f680
push str.System_Information_N532
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TBPSSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tcpiprNet
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tcpr32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tcpr64
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Tcpz_x86
mov ecx, 0x5b5b90
call fcn.0050f680
push str.tdydowkc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TelevisionFanaticService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TrkNetsSvcs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TrkSvr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.TrustCleanerDriver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UniversalUpdater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_AdvanceElite
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_AppEnable
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_BrowseStudio
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_Clock_Hand
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_Framed_Display
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_Fresh_Outlook
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_Great_Hub
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Update_Oasis_Space
mov ecx, 0x5b5b90
call fcn.0050f680
push str.upgs
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Upy10
mov ecx, 0x5b5b90
call fcn.0050f680
push str.usbewt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.userinfo32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Util_AdvanceElite
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Util_AppEnable
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Util_BrowseStudio
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Util_Clock_Hand
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Util_Framed_Display
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Util_Fresh_Outlook
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Util_Great_Hub
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Util_Oasis_Space
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x589218
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vezsrb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VisionService
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vmbbqh
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vspf
mov ecx, 0x5b5b90
call fcn.0050f680
push str.vspf_hk
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Vwxyab_Defghijk_Mno
mov ecx, 0x5b5b90
call fcn.0050f680
push str.VxDVSPF_HK
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wajam_Internet_Enhancer_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WajamUpdater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WajamUpdaterV2
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WajamUpdaterV3
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WaquSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WdMan
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WdsManPro
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WebSecService
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5892e8
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5892f4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.win32x
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Win2x
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winapiserv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wincom32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinCXC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinDefender
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Defender_User_Interface
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Help_System_Myss
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Internet_Name_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_MSI
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Protection_Updater
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsDriver
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsInput
mov ecx, 0x5b5b90
call fcn.0050f680
push str.windowsmanagementservice
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5893fc
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x589414
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsRemote
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WindowsUpdateServices
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinHelps
mov ecx, 0x5b5b90
call fcn.0050f680
push str.winik
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winimanr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinMgct
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Winmon
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinmonFS
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinmonProcessMonitor
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinSamSs
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5894b4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinService32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinToolsSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WinTrust
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5894e4
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WMCSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WmiHardwareSrv
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WMISYNC
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WMSendSer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WMSml
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x58951c
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wpennybeed
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x589530
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wsaknr_witclsja
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WSCM
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wsfit32
mov ecx, 0x5b5b90
call fcn.0050f680
push str.wsldoekd
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wsrnho_smaglzxo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WSszcok_vwcxjxwb
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wstlzq_hbkhyzae
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Wsvffz_kgnwuald
mov ecx, 0x5b5b90
call fcn.0050f680
push str.WsysSvc
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xptptt
mov ecx, 0x5b5b90
call fcn.0050f680
push str.xptpmm
mov ecx, 0x5b5b90
call fcn.0050f680
push str.yvsvga
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ycsvga
mov ecx, 0x5b5b90
call fcn.0050f680
push str.yyooyyoo
mov ecx, 0x5b5b90
call fcn.0050f680
push str.zaok
mov ecx, 0x5b5b90
call fcn.0050f680
push str.zcengine
mov ecx, 0x5b5b90
call fcn.0050f680
push str.zcwfp
mov ecx, 0x5b5b90
call fcn.0050f680
push str.zdengine
mov ecx, 0x5b5b90
call fcn.0050f680
push str.zdwfp
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x589608
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Zwunzi_Service
mov ecx, 0x5b5b90
call fcn.0050f680
push str.elaebtmkwz
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ktnjqlexhv
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4c96c0
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b48
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c977c
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str._s_Service
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str._s_Monitor
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x58964c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
jmp 0x4c96b3
mov dword [0x5b84b8], 0
jmp 0x4c9797
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4c99f6
push 0x5b8df0
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4c97d4
jmp 0x4c9788
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x589660
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4c984a
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push 0x589688
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SystemControlSet002Services_s
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SystemCurrentControlSetControlSafeBootMinimal_s
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x589700
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SystemCurrentControlSetControlSafeBootNetwork_s
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
push str..sys
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402a6b
add esp, 8
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str.SystemCurrentControlSetEnumRootLEGACY__s
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.004d6b35
add esp, 8
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str.SystemControlSet002EnumRootLEGACY__s
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.004d6b35
add esp, 8
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
jmp 0x4c9788
lea edx, [ebp - 0xa30]
push edx
push 0x20119
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ca8b5
mov dword [ebp - 0xa24], 0
push 0x200
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0xa24]
mov dword [ebp - 0x14e8], ecx
mov edx, dword [ebp - 0x14e8]
push edx
mov eax, dword [ebp - 0xa30]
push eax
mov ecx, dword [ebp - 0xa24]
add ecx, 1
mov dword [ebp - 0xa24], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4c9a6a
jmp 0x4ca8a8
push str.Your_Image_File_Name_Here_without_a_path
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4c9a84
jmp 0x4c9a26
lea eax, [ebp - 0x61c]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_s
lea ecx, [ebp - 0x81c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Debugger
lea edx, [ebp - 0x81c]
push edx
push 0x80000002
lea eax, [ebp - 0x12c4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14ec], eax
mov ecx, dword [ebp - 0x14ec]
mov dword [ebp - 0x14f0], ecx
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x14f0]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c4]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
lea eax, [ebp - 0x61c]
push eax
call fcn.00401fca
add esp, 4
push 0x589878
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4c9b4b
push 0x5b8df4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4c9b50
jmp 0x4c9a26
push str.AUTOREACTIVATOR.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c9be6
push str.DOTNETFXINSTALLBLOCK.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c9be6
push str.PMLAUNCHER.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c9be6
push str.PROCEXP.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4c9be6
push str.PROCMGR.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4c9beb
jmp 0x4c9a26
push 0x5898d8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.315LOAD32.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.AHUI.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.ALG.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589904
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.CMD.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.COMINE.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x58992c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.DRIVERS.CAB.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589948
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.EUAIE.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.EXPLORER32DBG.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.FIXMAPI.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.FONTS.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.FONTSWINSE.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.FUWUQI.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.GQXASMR.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x5899b4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.IEXPLORE_DBG.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.KLOMP.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.KMS_QADHOOKER.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.LOCALE.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.LOUSE.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589a10
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.MSIEXEC.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589a2c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.NQIJ.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.NSJW.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.P9KDMF.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.PROFHLP.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.PROTECTOR_
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.RNDLL32.PIF
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589a80
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.SECOH_QAD.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589aa0
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.SPPEXTCOMOBJPATCHER.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.SSDPDISCOVV.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589ad8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.TASKKILL.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.TASKLIST.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.TSKMGR.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.WAUC11.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589b1c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.WUAUC1T.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589b38
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.DLLCACHEWUAUCLT.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push str.MICROSOFT_COMMONWUAUCLT.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ca5c5
push 0x589b7c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.ANTIVIRUS_SYSTEM
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.NTSD__D
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push 0x589b9c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push 0x589ba4
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.APPSVC.EXE
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.AYWA539E.EXE
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push 0x589bcc
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.CHROME.EXE
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.CHROMEUPDATE.EXE
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push 0x589bf8
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.DEALPLYLIVE.EXE
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.MAGNIFY.EXE
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push str.MBAM.EXE
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ca5c5
push 0x589d18
push 0x54
push str.Prueba
lea eax, [ebp - 0x81c]
push eax
push 0x80000002
call fcn.00402bb9
add esp, 0x14
test eax, eax
je 0x4ca5fd
lea ecx, [ebp - 0x81c]
push ecx
push 0x80000002
call fcn.004d6b35
add esp, 8
lea edx, [ebp - 0x81c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4ca676
lea eax, [ebp - 0x61c]
push eax
push str.Eliminada_Clave___HKLM...Image_File_Execution_Options_s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov ecx, dword [ebp - 0x414]
push ecx
push 0x589d64
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov edx, dword [ebp - 0xa24]
sub edx, 1
mov dword [ebp - 0xa24], edx
jmp 0x4ca8a3
jmp 0x4c9a26
mov edx, dword [ebp - 0xa30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftInternet_ExplorerAboutURLs
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.html_unresident
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.html_stopengine
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.html_gotowork
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.html_onlyone
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.html_reconfig3
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.html_reconfig5
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.html_reconfig9
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.CLSID3EA5C408_2437_4C40_ADAC_DFDA9AEEEA96
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars3EA5C408_2437_4C40_ADAC_DFDA9AEEEA96
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerCassandra
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftWareMicrosoftInternet_ExplorerSettings
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Control_Date
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.ControlID
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.TODO_Count
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.TODO_Item_Data1_1
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.TODO_Item_Data2_1
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.TODO_Item_Data3_1
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.TODO_Item_Data1_2
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.TODO_Item_Data2_2
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.TODO_Item_Data3_2
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.GUID
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b7ba4
push str._sProgram_FilesBlock_CheckerBLOCK_CHECKER.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push str.SoftWareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareVB_and_VBA_Program_SettingsIMAdvertiser
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58a17c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.8636065b_fef0_4255_b14f_54639f7900a4
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy7F1796B2_BEC6_427B_B734_F9C75ED94A80
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy8C338DDB_19FC_4C1F_B74D_6931EE55F7A1
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwareDefaultTab
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsC9C42510_9B41_42c1_9DCD_7282A2D07C61C
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareGooglechromeExtensionsihflimipbcaljfnojhhknppphnnciiif
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicyFFDF9EF3_3C3A_4f05_9A6E_5D3B778EC567
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwarePassWidget
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58a3f8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.A9CD6C59_1033_A040_1B83_A6DB7FA114F8
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwarePriceGong
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwarePriceGong2
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareGooglechromeExtensions_bkomkajifikmkfnjgphkjcfeepbnojok
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMozillaFirefoxExtensions
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.8A9386B4_E958_4c4c_ADF4_8F26DB3E4829
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwarePricePeep
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58a560
push 0x58a564
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58a5a4
push 0x58a5a8
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58a5e8
push 0x58a5ec
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58a61c
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerToolbar
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.TypeLib93D511B5_143B_4A99_ABFC_B5B78AD0AE1B
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.SettingsManagerIEHelper.DNSGuard
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.SettingsManagerIEHelper.DNSGuard.1
push 0x80000000
call fcn.00402a6b
add esp, 8
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects934B156A_3D17_3981_B78A_5C138F423AD6
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58a750
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionPoliciesExtCLSID
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.934B156A_3D17_3981_B78A_5C138F423AD6
push str..Default_active_permissions
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SystemCurrentControlSetServicesEventlogApplicationWajamUpdater
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMozillaPlugins_ei.Zwinky_5q.com_Plugin
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.CLSIDFD16D053_9FE3_4bc1_BBDF_4D0FE927B9B2
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionApp_ManagementARPCacheLuckyBuy
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMenuExtRSDN_Search
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58a938
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.sysco
push 0x58a980
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.spvl
push str.SystemCurrentControlSetHardware_ProfilesCurrentSoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58aa68
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.eee0bd2f_ff2e_46ef_83fb_d4fda84462a3
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.CLSID5E2121EE_0300_11D4_8D3B_444553540000
push 0x80000000
call fcn.00402a6b
add esp, 8
push str._shellexContextMenuHandlersSimpleShlExt
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.Folder_shellexContextMenuHandlersSimpleShlExt
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x58ab28
push 0x58ab34
push 0x80000002
lea eax, [ebp - 0x12c8]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14f4], eax
mov ecx, dword [ebp - 0x14f4]
mov dword [ebp - 0x14f8], ecx
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x14f8]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c8]
call sub.MFC42.DLL_CString::CString
push str.UserSession
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b8df8
lea eax, [ebp - 0x414]
push eax
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4cafc4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x1230]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b78a4
push 0x58ab90
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
lea eax, [ebp - 0x1230]
push eax
push 0x5b78a4
push str._sSoftware_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.CLSID72FE8681_0BFA_471B_9B2A_B37ED68DD09E
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.CLSIDB0DE3308_5D5A_470D_81B9_634FC078393B
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftWareMicrosoftWindowsCurrentVersionInternet_Settings5.0User_AgentPost_Platform
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.AskTb_
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionMCD
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.csrcs
push 0x58acd0
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionStrtdCfg
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x58ad3c
push str.VBEFileShellOpen
push 0x80000000
call fcn.00402ed5
add esp, 0xc
push 0x58ad58
push str.VBEFileShellOpen2
push 0x80000000
call fcn.00402ed5
add esp, 0xc
push 0x58ad74
push str.VBSFileShellOpen
push 0x80000000
call fcn.00402ed5
add esp, 0xc
push str.Command
push str.VBSFileShellOpen2
push 0x80000000
call fcn.00402ed5
add esp, 0xc
push 0x58adac
push 0x58adb4
push 0x80000002
lea ecx, [ebp - 0x12cc]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x14fc], eax
mov edx, dword [ebp - 0x14fc]
mov dword [ebp - 0x1500], edx
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x1500]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12cc]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58ade4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cb18a
push 0x58adec
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cb18a
mov ecx, dword [ebp - 0x414]
push ecx
push str.Entrada_Eliminada__HKLM...Run___Norton___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x58ae28
push 0x58ae30
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58ae60
push 0x58ae68
push 0x80000002
lea edx, [ebp - 0x12d0]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1504], eax
mov eax, dword [ebp - 0x1504]
mov dword [ebp - 0x1508], eax
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x1508]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12d0]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58aea4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cb266
push str.SYSTEN.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cb266
mov edx, dword [ebp - 0x414]
push edx
push str.Entrada_Eliminada__HKLM...Wow6432Node...Run___Norton___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.Norton
push 0x58af00
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.Hyden
push 0x58af44
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.matriz
push 0x58af88
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.MCVMMC
push 0x58afc8
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareVB_and_VBA_Program_SettingsMicrosoftSysProgs
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.Hhyden
push str.SystemCurrentControlSetControlSession_ManagerKnownDLLs
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.winlogonn
push 0x58b090
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58b0c8
push 0x58b0d4
push 0x80000002
lea eax, [ebp - 0x12d4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x150c], eax
mov ecx, dword [ebp - 0x150c]
mov dword [ebp - 0x1510], ecx
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x1510]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12d4]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.SETCH.VBE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cb39f
push str._SystemRoot__system32_spoolsv.exe
push 0x45
push 0x58b130
push str.SYSTEMCurrentControlSetServicesSpooler
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.ClipBooks
push str.SoftwareMicrosoftWindows_NTCurrentVersionSvcHost
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.ctfnom
push 0x58b1b4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SRDSL
push 0x58b1f4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.scvhost
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftWareMicrosoftNetscapeNetscape_NavigatorViewers
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.application_x_iad
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.application_x_bwpreview
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindowsIComplemento
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.26132B07
push 0x58b308
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.8B1BD1F6
push 0x58b340
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.uniq_id
push 0x58b374
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.logurl
push 0x58b398
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.type
push 0x58b3bc
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SystemCurrentControlSetControlMPRServicesTestService
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x58b414
push 0x58b424
push 0x80000002
lea eax, [ebp - 0x12d8]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1514], eax
mov ecx, dword [ebp - 0x1514]
mov dword [ebp - 0x1518], ecx
mov byte [ebp - 4], 0x2b
mov edx, dword [ebp - 0x1518]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12d8]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58b454
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cb5b4
push str.WINDLL_32.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cb5b4
mov eax, dword [ebp - 0x414]
push eax
push str.Entrada_Eliminada__HKLM...Run___GrooveMonitor___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.GrooveMonitor
push 0x58b4b4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sFrmPrincipal
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerDownload
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58b528
push 0x54
push str.CheckExeSignatures
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push str.RunInvalidSignatures
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sWinampAgent
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareClassesCLSIDfbeb8a05_beee_4442_804e_409d6c4515e9InprocServer32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58b5b8
push 0x5b6504
push 0x80000003
lea ecx, [ebp - 0x12dc]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x151c], eax
mov edx, dword [ebp - 0x151c]
mov dword [ebp - 0x1520], edx
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x1520]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x1230]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12dc]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1230]
push ecx
call fcn.00401fca
add esp, 4
push str.YGPACK_
lea edx, [ebp - 0x1230]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cb772
push 0x5b78a4
push str._sSoftwareClassesCLSID
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.004d6b35
add esp, 8
push 0x5b78a4
push str._sSoftwareClassesCLSIDfbeb8a05_beee_4442_804e_409d6c4515e9
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
test eax, eax
jne 0x4cb772
push 0x5b79a4
push str.Eliminada_Class___fbeb8a05_beee_4442_804e_409d6c4515e9___Usuario:__s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMenuExt__
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionRunWindowsUpdate
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareVB_and_VBA_Program_SettingsSysUpdate_sistema
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindows_nScan32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58b754
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Intelli_Mouse_Pro_Version_2.0B
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SystemCurrentControlSetControlSafeBootMinimaldllcache
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SystemCurrentControlSetControlSafeBootNetworkdllcache
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58b81c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.nok01
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.nok02
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SystemCheck2
push 0x58b874
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftInternet_ExplorerAdvancedOptions_CNS
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.PROTOCOLSHandlercn
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.PROTOCOLSHandler_tbr
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.IEWatsonEnabled
push 0x58b938
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionInstallerUserDataCrawler
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwareCrossrider
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58b9d8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58ba08
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftWareMicrosoft_st3
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58ba28
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.syst32
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SystemCurrentControlSetControlSafeBootMinimal_beep.sys
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.CLSIDInprocServer32
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftWareMicrosoftWindowsCurrentVersionDateTime
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58baec
push 0x58baf8
push 0x80000002
lea eax, [ebp - 0x12e0]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1524], eax
mov ecx, dword [ebp - 0x1524]
mov dword [ebp - 0x1528], ecx
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0x1528]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12e0]
call sub.MFC42.DLL_CString::CString
push 0x58bb24
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cbaa2
push 0x58bb2c
push 0x45
push 0x58bb5c
push str.SYSTEMCurrentControlSetServicesSchedule
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.gootkitsso
push 0x58bba0
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58bbe8
push 0x58bbec
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.izpInit_Dlls
push str.SoftWareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftWareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects628B20EF_3374_4A1B_AFC3_1F86BE8C_C78AFC3_1F86BE8C0C78
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.RegistryMonitor2
push 0x58bcf8
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str._shellexContextMenuHandlersReliveHookDLL
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftWareMicrosoftWindowsCurrentVersionInternet_SettingsUser_AgentPost_Platform
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.snprtzdialno
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58bdbc
push 0x58bdc8
push 0x80000002
lea eax, [ebp - 0x12e4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x152c], eax
mov ecx, dword [ebp - 0x152c]
mov dword [ebp - 0x1530], ecx
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x1530]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12e4]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.USRSDPIA.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cbbed
push str._SystemRoot_System32_svchost.exe__k_LocalService
push 0x45
push 0x58be40
push str.SYSTEMCurrentControlSetServicesRemoteRegistry
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x58be80
push 0x58be84
push 0x80000000
lea eax, [ebp - 0x12e8]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1534], eax
mov ecx, dword [ebp - 0x1534]
mov dword [ebp - 0x1538], ecx
mov byte [ebp - 4], 0x2f
mov edx, dword [ebp - 0x1538]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12e8]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.CHECKWEB.DLL
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cbcad
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Webcheck.dll
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x54
push 0x58bee0
push str.CLSIDE6FB5E20_DE35_11CF_9C87_00AA005127EDInProcServer32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.SoftwareMicrosoftWindowsCurrentVersionuuid
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.uuid
push 0x58bf58
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionp_solicies
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x58bfbc
push str.SoftWareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftWareMicrosoftWindowsCurrentVersionRunm
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58c020
push 0x58c024
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftActive_SetupInstalled_Components29C400A3_2669_43D2_A1F1_0D0DB9453F5F
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.0000000F
push 0x58c0bc
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.00E35EEE
push 0x58c0dc
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58c0f0
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.DOS_STUB
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.ImageBase
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.IMAGE_FILE_HEADER
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftOfficeOutlookAddinsewwotb.addin.1
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov ecx, 0x5b7658
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Error_Safe_FreeESSPChck.dll
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x58c184
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.CLSID50B4D2B3_723F_41B3_AEC4_0BD66F0F45FF
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.CLSIDA166C1B0_5CDB_447A_894A_4B9FD7149D51
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars50B4D2B3_723F_41B3_AEC4_0BD66F0F45FF
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerExplorer_BarsA166C1B0_5CDB_447A_894A_4B9FD7149D51
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftWareUninstall
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.pR1mkTpYgs
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.vYqwENAfWM
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareClasses.exe
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareClassesexefile
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareClassesmdaw
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str..exeDefaultIcon
push 0x80000000
call fcn.00402a6b
add esp, 8
push str..exe_shell
push 0x80000000
call fcn.00402a6b
add esp, 8
mov ecx, 0x5b7658
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Internet_Exploreriexplore.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x54
push 0x58c398
push str.SoftwareClientsStartMenuInternetIEXPLORE.EXE_shellopencommand
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x25
push 0x5b78a4
push str._sSoftwareClasses_cs
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x58c3f8
push 0x5b6504
push 0x80000003
lea eax, [ebp - 0x12ec]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x153c], eax
mov ecx, dword [ebp - 0x153c]
mov dword [ebp - 0x1540], ecx
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x1540]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12ec]
call sub.MFC42.DLL_CString::CString
push 0x58c3fc
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cc0c2
push 0x5b8dfc
lea eax, [ebp - 0x414]
push eax
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4cc0c2
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
mov ecx, dword [ebp - 0x414]
push ecx
push 0x5b78a4
push str._sSoftwareClasses_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58c41c
push 0x58c42c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58c468
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.CertDig
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.KeyTest
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareClassesFrameGrabber.Application
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58c4dc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.12B79064_EB17_4f82_9DFE_B975BD26D1DC
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.75fa38b7_8b94_4995_ad32_52e938867954
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58c538
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.BootData
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58c55c
push 0x58c570
push 0x80000002
lea edx, [ebp - 0x12f0]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1544], eax
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], eax
mov byte [ebp - 4], 0x31
mov ecx, dword [ebp - 0x1548]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12f0]
call sub.MFC42.DLL_CString::CString
push 0x58c5a0
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cc259
mov edx, dword [ebp - 0x414]
push edx
push str.Entrada_Eliminada__HKLM...Run___SunJavaUpdateSched___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.SunJavaUpdateSched
push 0x58c600
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.1.Console_Flash_CF.v5
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.1.Console_Flash_v.4.1
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionRuins
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionUrls
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersion_r
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x58c6f0
push 0x58c6f8
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRuins
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUrls
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersion_r
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x58c7e4
push 0x58c7ec
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.CLSIDF5734812_E6A1_8833_ECA9_949B5B8A88BF
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.PROTOCOLSHandleric32pp
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.MSCOMCTL.OCX
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x58c88c
push 0x58c890
push 0x80000000
lea eax, [ebp - 0x12f4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x154c], eax
mov ecx, dword [ebp - 0x154c]
mov dword [ebp - 0x1550], ecx
mov byte [ebp - 4], 0x32
mov edx, dword [ebp - 0x1550]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12f4]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58c8cc
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cc47b
push 0x58c8d4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cc47b
push 0x5b6504
lea eax, [ebp - 0x1230]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
push 0x54
push 0x58c8e0
push str.CLSID1EFB6596_857C_11D1_B16A_00C0F0283628InprocServer32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x5b6504
lea edx, [ebp - 0x1230]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.__10
lea eax, [ebp - 0x1230]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
push 0x54
push 0x58c928
push str.CLSID1EFB6596_857C_11D1_B16A_00C0F0283628ToolboxBitmap32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x58c96c
push 0x58c970
push 0x80000000
lea edx, [ebp - 0x12f8]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x1554]
mov dword [ebp - 0x1558], eax
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x1558]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12f8]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58c9ac
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cc597
push 0x58c9b4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cc597
push 0x5b6504
lea edx, [ebp - 0x1230]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x1230]
push eax
push 0x54
push 0x58c9c0
push str.CLSID2C247F23_8591_11D1_B16A_00C0F0283628InprocServer32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x5b6504
lea ecx, [ebp - 0x1230]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x58ca00
lea edx, [ebp - 0x1230]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x1230]
push eax
push 0x54
push 0x58ca04
push str.CLSID2C247F23_8591_11D1_B16A_00C0F0283628ToolboxBitmap32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x58ca48
push 0x58ca4c
push 0x80000000
lea ecx, [ebp - 0x12fc]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x155c], eax
mov edx, dword [ebp - 0x155c]
mov dword [ebp - 0x1560], edx
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x1560]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12fc]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58ca88
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cc6b3
push 0x58ca90
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cc6b3
push 0x5b6504
lea ecx, [ebp - 0x1230]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x1230]
push edx
push 0x54
push 0x58ca9c
push str.CLSID66833FE6_8583_11D1_B16A_00C0F0283628InprocServer32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x5b6504
lea eax, [ebp - 0x1230]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.__12
lea ecx, [ebp - 0x1230]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x1230]
push edx
push 0x54
push 0x58cae4
push str.CLSID66833FE6_8583_11D1_B16A_00C0F0283628ToolboxBitmap32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x58cb28
push 0x58cb2c
push 0x80000000
lea eax, [ebp - 0x1300]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1564], eax
mov ecx, dword [ebp - 0x1564]
mov dword [ebp - 0x1568], ecx
mov byte [ebp - 4], 0x35
mov edx, dword [ebp - 0x1568]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1300]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58cb68
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cc7cf
push 0x58cb70
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cc7cf
push 0x5b6504
lea eax, [ebp - 0x1230]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
push 0x54
push 0x58cb7c
push str.CLSIDBDD1F04B_858B_11D1_B16A_00C0F0283628InprocServer32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x5b6504
lea edx, [ebp - 0x1230]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x58cbbc
lea eax, [ebp - 0x1230]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x1230]
push ecx
push 0x54
push 0x58cbc0
push str.CLSIDBDD1F04B_858B_11D1_B16A_00C0F0283628ToolboxBitmap32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x58cc04
push 0x58cc08
push 0x80000000
lea edx, [ebp - 0x1304]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x156c], eax
mov eax, dword [ebp - 0x156c]
mov dword [ebp - 0x1570], eax
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x1570]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1304]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58cc44
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cc8eb
push str.AGSEYAPP
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cc8eb
push 0x5b6504
lea edx, [ebp - 0x1230]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x1230]
push eax
push 0x54
push 0x58cc58
push str.CLSIDC74190B6_8589_11D1_B16A_00C0F0283628InprocServer32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x5b6504
lea ecx, [ebp - 0x1230]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x58cc98
lea edx, [ebp - 0x1230]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x1230]
push eax
push 0x54
push 0x58cc9c
push str.CLSIDC74190B6_8589_11D1_B16A_00C0F0283628ToolboxBitmap32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.SoftwareMicrosoftWindowsCurrentVersionBcogoyuyeb
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftOfficeOutlookAddinsHbtHostOL.HbtMailAnim
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.CLSID281A215D_01BF_3082_0210_999811130022
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Downloaded_Program_Filesistactivex.dll
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x58cdb4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0xa28], eax
mov dword [0x5b84b8], 0
jmp 0x4cc98a
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0xa28]
jge 0x4cc9b8
mov eax, dword [0x5b84b8]
movsx ecx, byte [eax + 0x5b6504]
cmp ecx, 0x5c
jne 0x4cc9b6
mov edx, dword [0x5b84b8]
mov byte [edx + 0x5b6504], 0x2f
jmp 0x4cc97b
push str.SoftwareMicrosoftWindowsCurrentVersionModuleUsage_
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58ce24
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58ce30
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58ce34
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58ce38
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58ce3c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58ce40
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58ce44
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.SEE_MASK_NOZONECHECKS
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareClassesCLSIDmscfile
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.msnmsgr
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58ced0
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58cef8
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1308]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1578], eax
mov byte [ebp - 4], 0x37
mov ecx, dword [ebp - 0x1578]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1308]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.VBC.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ccbd8
push 0x5b78a4
push 0x58cf0c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b8e00
push 0x54
push 0x58cf34
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push str._sBNB
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sXMTT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sXU
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sXXUX
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsX
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftActive_SetupInstalled_Components
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push str._s97A8EC5C_1AFA_AFCC_EB69_B8AD0DAEFA9D
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
lea ecx, [ebp - 0x61c]
push ecx
push str._sB6CDEEF5_E0CB_D7F3_E21C_A9BEFE3EEBD3
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
lea edx, [ebp - 0x61c]
push edx
push str._sCA1EDAAA_DD84_EABB_51AB_CEDCD3CDFC1B
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push str._sCEA3DBFE_B27F_BA2B_D8A2_8C6F60FBBC65
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
lea ecx, [ebp - 0x61c]
push ecx
push str._sCFB3DFAD_DEAB_9CDB_FADA_AC0C1646D9CD
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
lea edx, [ebp - 0x61c]
push edx
push str._sE994FDE9_A9AC_AEEF_B960_A7DAFDB5DBDF
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push str._sF5CAC3FB_AB05_FFAF_526F_09BFCFF8DCAD
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58d0e8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58d11c
push 0x5b6504
push 0x80000003
lea ecx, [ebp - 0x130c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x157c], eax
mov edx, dword [ebp - 0x157c]
mov dword [ebp - 0x1580], edx
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0x1580]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130c]
call sub.MFC42.DLL_CString::CString
push 0x58d130
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ccee0
mov ecx, dword [ebp - 0x414]
push ecx
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s...Run___Windows_Defender___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x5b78a4
push 0x58d178
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58d1ac
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58d1c0
push 0x58d1d4
push 0x80000002
lea edx, [ebp - 0x1310]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1584], eax
mov eax, dword [ebp - 0x1584]
mov dword [ebp - 0x1588], eax
mov byte [ebp - 4], 0x39
mov ecx, dword [ebp - 0x1588]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1310]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58d204
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ccfbc
push 0x58d20c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ccfbc
mov edx, dword [ebp - 0x414]
push edx
push str.Entrada_Eliminada__HKLM...Run___Windows_Defender___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x58d268
push 0x58d27c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58d2ac
push 0x58d2c0
push 0x80000002
lea eax, [ebp - 0x1314]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x158c], eax
mov ecx, dword [ebp - 0x158c]
mov dword [ebp - 0x1590], ecx
mov byte [ebp - 4], 0x3a
mov edx, dword [ebp - 0x1590]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1314]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58d2fc
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cd098
push str.WINDOWS_DEFENDERMSASCUI.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cd098
mov eax, dword [ebp - 0x414]
push eax
push str.Entrada_Eliminada__HKLM...Wow6432Node...Run____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.Windows_Defender
push 0x58d370
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerAdvancedOptionsHcahc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsHcahc
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftOfficeOutlookAddinsOutlookAddin.Addin
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.Virus_Heuric_2008_
push 0x58d46c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.WinHeuric
push 0x58d4a4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sIdentities346C2A77_A02C_F7E2_19F0_64A0B2E4F790
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareClassesApplicationsinetstat.exe
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58d538
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.idln2
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58d558
push 0x58d55c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareClassesCLSIDE32F68E6_702C_072F_6004_1BD1EBE978BB
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.msnmsg
push 0x58d5c0
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExtensions
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Servicio
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareVB_and_VBA_Program_SettingsParanoid
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwarePennyBee
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sRappa
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.marker_UAC_bypassed
push 0x58d6b4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.marker_gjru_fbegrihlgm
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftActive_SetupInstalled_Components05F16C88_71D3_42C1_BB4F_E9BAF7DB4A9E
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58d78c
push 0x58d7a4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Windows32KernelStart
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionProfiler
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SystemCurrentControlSet_serviceseventlogApplicationWsysSvc
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.CLSID9DFD0A51_6176_5770_217C_A5BCD7E6F3E2
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.CLSIDA5C70510_5A01_B2A5_CF84_D6DC13859967
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerRun
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x58d93c
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58d964
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58d98c
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftOfficeCommonSmart_Tag
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsBROWSESMARTTAGS
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x58da2c
push 0x58da30
push 0x80000000
lea ecx, [ebp - 0x1318]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1594], eax
mov edx, dword [ebp - 0x1594]
mov dword [ebp - 0x1598], edx
mov byte [ebp - 4], 0x3b
mov eax, dword [ebp - 0x1598]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1318]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.__WMIPRVI.DLL
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cd4bd
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.WbemWmiprvsd.dll
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x54
push 0x58da90
push str.CLSID4DE225BF_CF59_4CFC_85F7_68B90F185355InprocServer32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push 0x58dad0
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58db0c
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58db30
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58db6c
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.CLSID0494D0DE_F8E0_41ad_92A3_14154ECE70AC
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str.MySearchToolBar.NetscapeShutdown.1
push str._sSoftwareNetscapeNetscape_NavigatorAutomation_Shutdown
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.MyWayToolBar.NetscapeShutdown.1
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str.MySearchToolBar.NetscapeStartup.1
push str._sSoftwareNetscapeNetscape_NavigatorAutomation_Startup
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.MyWayToolBar.NetscapeStartup.1
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.CLSID1E0DE227_5CE4_4EA3_AB0C_8B03E1AA76BC
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMenuExtSearch
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftMultimediaWMPlayerSchemes_f3pss
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftOfficeOutlookAddinsMyWebSearch.OutlookAddin
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftOfficeWordAddinsMyWebSearch.OutlookAddin
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x58dde4
push 0x58ddf4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.f3PopularScreensavers
push str.SoftwareMicrosoftWindows_MediaWMSDK_sources
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftShared_toolsMsconfigStartupregMyWebSearch_Plugin
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareClassesSoftwareClassesQuickSearch.SearchBand
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.CLSID460E0A9C_90AA_8CC7_25A0_52A2C5B5EFF42
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.CLSID29A5EA88_29A5_EA88_29A5_EA8829A5EA88
push 0x80000000
call fcn.00402a6b
add esp, 8
push str._SystemRoot_System32P2P_Networking_v126.cpl
push str.SoftwareMicrosoftWindowsCurrentVersionControl_PanelExtended_Properties305CA226_D286_468e_B848_2B2E8E697B74_2
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sEnvironment
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.AVAPP
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.AVUNINST
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.InternetProvider
push 0x58e058
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.UDFBCXC
push 0x58e0a8
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.ATI_VER
push str.SoftwareMicrosoft
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str..DefaultAMService
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftWareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objecta
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftWareMicrosoftWindowsCurre
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.CLSIDVMHomepage
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.CLSIDVMHomepage.1
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftWareInternet_Security
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.65005
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.65010
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.Removable
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerURLSearchHooks
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.84FF7BD6_B47F_46F8_9130_01B2696B36CB
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftWareWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects84FF7BD6_B47F_46F8_9130_01B2696B36CB
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftWareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsA5A51D2A_505A_4D84_AFC6_E0FA87E47B8C
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.midi9
push str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.CLSIDBB4C402F_882A_8C08_4526_51278EA437C1
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.CLSIDBD344AF4_67AB_A630_4E19_7435587D320B
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.CLSIDMADOWN
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58e3f8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58e42c
push 0x5b6504
push 0x80000003
lea ecx, [ebp - 0x131c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x159c], eax
mov edx, dword [ebp - 0x159c]
mov dword [ebp - 0x15a0], edx
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp - 0x15a0]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x131c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.NODQQ.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cd93b
push 0x5b78a4
push 0x58e440
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Nod32
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.atolsv
push 0x58e484
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareAppDataLow5c4e15de_83a5_60c0_f21f_46c3f4a968ed
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.rtcsinst
push str.SystemCurrentControlSetControlSession_ManagerAppCertDlls
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58e550
push str.SystemCurrentControlSetServicesTcpipParametersinterfacewindows
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58e59c
push 0x58e5a0
push 0x80000002
lea ecx, [ebp - 0x1320]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15a4], eax
mov edx, dword [ebp - 0x15a4]
mov dword [ebp - 0x15a8], edx
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x15a8]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1320]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.AVP.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cda3f
push 0x58e5d8
push 0x58e5dc
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58e60c
push 0x58e610
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionFlgkmream
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58e680
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.SysHelper
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFindExtensionsStaticRegFreeze
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerSSavage
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerSSavage
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SystemLastKnownGoodRecovery
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMenuExtNet_Search
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMenuExtFreeRIP_Search
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58e828
mov ecx, 0x5b4e2c
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cdce5
push 0x5b8e04
mov ecx, 0x5b4e2c
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4cdce5
mov ecx, 0x5b4e2c
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0xa28], eax
mov eax, dword [ebp - 0xa28]
mov dword [0x5b84b8], eax
jmp 0x4cdbef
mov ecx, dword [0x5b84b8]
sub ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0xffffffff
jle 0x4cdc0f
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x61c]
cmp eax, 0x5c
jne 0x4cdc0d
jmp 0x4cdc0f
jmp 0x4cdbe0
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov dword [ebp - 0xa20], 0
jmp 0x4cdc48
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [ebp - 0xa20]
add eax, 1
mov dword [ebp - 0xa20], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0xa28]
jge 0x4cdc87
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x61c]
cmp eax, 0x2e
jne 0x4cdc6b
jmp 0x4cdc87
mov ecx, dword [ebp - 0xa20]
mov edx, dword [0x5b84b8]
mov al, byte [ebp + edx - 0x61c]
mov byte [ebp + ecx - 0x61c], al
jmp 0x4cdc2a
mov ecx, dword [ebp - 0xa20]
mov byte [ebp + ecx - 0x61c], 0
push 0x5b8e08
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4cdce5
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonNotify_
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMenuExtMyToolBar_Search
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMainFeatureControl
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.FreeprodTB
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsUser_AgentPost_Platform
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftSystemCertificatesTrustedPublisherCertificates
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push str._sAB85382334DB4B209EB93C414D5959FB9A7E5778
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b6504
push str._sFF403D57ABD624ECB305F5012B8B450027000F5E
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerMSConfig
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SoftWareMicrosoftWindowsCurrentVersionSetup
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ridt100413
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58ea5c
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58ea60
push str.SoftWareMicrosoftWindowsCurrentVersion_services
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.CDRecorder029
push 0x58eaa8
push 0x80000002
call fcn.00402ed5
add esp, 0xc
test eax, eax
jne 0x4cde6d
cmp dword [0x5b851c], 0
jne 0x4cde59
push 0
push 0
push 0x58eaf0
call sub.MFC42.DLL_AfxMessageBox
push str.Eliminado_ShellServiceObjectDelayLoad___CDRecorder029_____SpamTool_n
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push 0x5b78a4
push 0x58eb90
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.installation_id
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSymantec_Fillter_Check
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSymantecFilterCheck
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b7bb4
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0xa28], eax
mov dword [0x5b84b8], 1
mov dword [ebp - 0xa20], 0
jmp 0x4cdf37
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [ebp - 0xa20]
add eax, 1
mov dword [ebp - 0xa20], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0xa28]
jge 0x4cdf5f
mov edx, dword [ebp - 0xa20]
mov eax, dword [0x5b84b8]
mov cl, byte [eax + 0x5b7bb4]
mov byte [ebp + edx - 0x40c], cl
jmp 0x4cdf19
mov edx, dword [ebp - 0xa20]
mov byte [ebp + edx - 0x40c], 0
push 0x5b78a4
push 0x58ec08
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsInstance_Rep_Creator
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerLowRegistryBlackberry
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Inform
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsWindows_Viewer_List
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsAtheros_Drivers_Updates_Imports
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsAt_Flash_Drivers_Updates
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsDrivers_ITM_SLI_Video
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsFlash_Update_Drivers_atx
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsGForce_Update_Drivers_SLI
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsSLI_Force_Drivers
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsUpdate_Live_Rep
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.PROTOCOLSHandlericoo
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._s_VenoM_Software_136811368113681
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58eea4
push 0x58eeac
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwareMicrosoftAAE659A3_0166_6C87_DB7E_C5603F92C994
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.CLSID957BAB51_81FF_8195_F273_D7E286EA702F
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionShellServiceObjectA2D9D3F0_8C2A_2A1D_A376_1BECFB10AB72
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.4E3E0230AEBB4E96
push str.S_1_5_19SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SystemCurrentControlSetServiceslanmanserverShares
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.PATRON1
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.PATRON2
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftOfficeOutlookAddinsSpy_Shield.Addin.1
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.CLSID5B55C4E3_C179_BA0B_B4FD_F2DB862D6202
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.ClassesSQLoader.Loader
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.ClassesSQLoader.Loader.1
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x58f100
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push str._sATLASSstp
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b6504
push str._sBHOASSstp
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b6504
push str._sHTASSstp
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b6504
push str._sMSMsgSvc
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b6504
push str._sSEHLPstp
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b6504
push str._sWTLBAstp
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.coolwwwsearch.com
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsSafeSites
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.DDE_Module
push 0x58f1e4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58f22c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.AppData
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58f268
push 0x58f270
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58f2b8
push 0x58f2c0
push 0x80000000
lea ecx, [ebp - 0x1324]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15ac], eax
mov edx, dword [ebp - 0x15ac]
mov dword [ebp - 0x15b0], edx
mov byte [ebp - 4], 0x3e
mov eax, dword [ebp - 0x15b0]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1324]
call sub.MFC42.DLL_CString::CString
push 0x58f2dc
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.PROTOCOLSFilter_text_html
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x58f300
push 0x58f308
push 0x80000000
lea ecx, [ebp - 0x1328]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15b4], eax
mov edx, dword [ebp - 0x15b4]
mov dword [ebp - 0x15b8], edx
mov byte [ebp - 4], 0x3f
mov eax, dword [ebp - 0x15b8]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1328]
call sub.MFC42.DLL_CString::CString
push str.CLSID_
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.PROTOCOLSFilter_text_plain
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMenuExtSuchen
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareVB_and_VBA_Program_SettingsIeMsnSbSrch_2
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.NeverSAcc
push 0x58f3c4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionRunOnceSrv32_spool_service
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceSrv32_spool_service
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftInternet_ExplorerMenuExtWeb_Rebates.
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x58f4c4
push str.SystemCurrentControlSetControlSafeBootMinimal
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.ctfmon.exe
push str.SystemCurrentControlSetControlSafeBootNetwork
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersion
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.NameDrv
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.WinSysDriverrs
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindows_NTCurrentVersionBindows
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareClassesCLSID0B88CE42_4CE4_42CF_9593_CA003943B6D2
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x61c]
push edx
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareClassesDriveShellExFolderExtensions0B88CE42_4CE4_42CF_9593_CA003943B6D2_
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.idstrf
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftware
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58f6b0
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.bins
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58f6bc
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58f6c0
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.veTime
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindows
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.AppPath
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Sidebar_32.3uu_
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerStartupApprovedStartupFolder
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Startup32.3uu.exe
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SystemCurrentControlSetServiceswuauserv
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x58f7e4
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
lea ecx, [ebp - 0x132c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15bc], eax
mov edx, dword [ebp - 0x15bc]
mov dword [ebp - 0x15c0], edx
mov byte [ebp - 4], 0x40
mov eax, dword [ebp - 0x15c0]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x132c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.DRIVERSSVCHOST.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ce9a7
push str._SystemRoot_System32_svchost.exe__k_netsvcs
push 0x45
push 0x58f834
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x58f840
push 0x44
push 0x58f844
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x58f84c
push 0x44
push str.ErrorControl
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.Parameters
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push str._SystemRoot_System32wuauserv.dll
push 0x45
push str.ServiceDll
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push str._sSoftwareClassesCLSIDF092840E_9235_5F9E_AA49_192D10BAB838
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x58f8e0
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftOLE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.DRam_prosessor
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58f91c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58f93c
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1330]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15c4], eax
mov eax, dword [ebp - 0x15c4]
mov dword [ebp - 0x15c8], eax
mov byte [ebp - 4], 0x41
mov ecx, dword [ebp - 0x15c8]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1330]
call sub.MFC42.DLL_CString::CString
push str.:__Nelly__:
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ceb2a
push 0x5b78a4
push str._sControl_PanelInternational
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b8e0c
push 0x54
push str.s1159
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x5b8e10
push 0x54
push str.s2359
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push str.H:mm:ss
push 0x54
push str.sTimeFormat
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x58f994
push 0x58f998
push 0x80000000
call fcn.00402ed5
add esp, 0xc
push 0x58f9d4
push 0x58f9d8
push 0x80000000
lea edx, [ebp - 0x1334]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15cc], eax
mov eax, dword [ebp - 0x15cc]
mov dword [ebp - 0x15d0], eax
mov byte [ebp - 4], 0x42
mov ecx, dword [ebp - 0x15d0]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1334]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call fcn.00401fca
add esp, 4
push str.RUNDLL32.EXE_JAVASCRIPT:_..MSHTML_RUNHTMLAPPLICATION__
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cec00
push str._SystemRoot_System32wbemwmiprvse.exe
push 0x45
push 0x58fa78
push str.CLSID73E709EA_5D93_4B2E_BBB0_99B7938DA9E4LocalServer32
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.Restaurada_Class__Microsoft_WMI_Provider_Subsystem_Host_______SystemRoot__system32wbemwmiprvse.exe__n
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x5b78a4
push 0x58fb20
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b79a4
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58fb54
push str.SoftwareMicrosoftSecurity_Center
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58fbc0
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push 0x58fbc4
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58fbec
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1338]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15d4], eax
mov eax, dword [ebp - 0x15d4]
mov dword [ebp - 0x15d8], eax
mov byte [ebp - 4], 0x43
mov ecx, dword [ebp - 0x15d8]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1338]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x58fbf4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ced41
push 0x5b78a4
push str._sSoftwareMicrosoftCommand_Processor
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b8e14
push 0x54
push str.AutoRun
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x58fc44
push 0x58fc50
push 0x80000002
lea edx, [ebp - 0x133c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15dc], eax
mov eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], eax
mov byte [ebp - 4], 0x44
mov ecx, dword [ebp - 0x15e0]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x133c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.FONTSNVCPL.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cedd6
push str.NvCplDaemon
push 0x58fc9c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sLANMedia2
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58fd1c
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x58fd30
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindowsload
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x58fdc0
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.MicrosoftWindows
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindowsload
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x58fe24
push 0x58fe30
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoft
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.PIDprocess
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Microsoft_Corporation
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.DisableSecuritySettingsCheck
push str.SoftwareMicrosoftInternet_ExplorerSecurity
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.DisableImprovedZoneCheck
push 0x58ff7c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.ZonesSecurityUpgradeDone
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.Security_HKLM_only
push str.SoftwarePoliciesMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x59006c
push 0x59007c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5900b4
push 0x5900c4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5900fc
push 0x59010c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x590150
push 0x590160
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.Chavez
push str.SoftwareMicrosoftWindows
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.CLSID46A4E9D9_B30E_452A_8157_DBBEC8573B03
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.CLSID74DD705D_6834_439C_A735_A6DBE2677452
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.74DD705D_6834_439C_A735_A6DBE2677452
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SSODL
push 0x590288
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.PROTOCOLSHandler_tpro
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.PROTOCOLSName_Space_Handler_res_toolbar.ResProtocol
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.PROTOCOLSName_Space_Handler_resWToolsB.ResProtocol
push 0x80000000
call fcn.00402a6b
add esp, 8
mov ecx, 0x5b765c
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.WinAntiVirus_Pro_2006WapCHK.dll
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.Component_Categories56FFCC30_D398_11D0_B2AE_00A0C908FA49
push 0x80000000
call fcn.00402a6b
add esp, 8
push str._shellexContextMenuHandlersShellExtension
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.Directory_shellexContextMenuHandlersShellExtension
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.Drive_shellexContextMenuHandlersShellExtension
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.Software915BCE91
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwareMicrosoft9BC17446_3E8A_85AC_20FF_528954A3A6CD
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareAppDataLowSoftwareMicrosoftBA7A730B_D14A_FC05_2B8E_95F08FA29924
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push str.Directory_shellexCopyHookHandlersTazebamaHook
push 0x80000000
call fcn.00402a6b
add esp, 8
push str.Microsoft_Synchronization_Manager
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareVB_and_VBA_Program_Settings_noGods
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareVB_and_VBA_Program_Settingsuntukmu
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
cmp dword [0x5b8500], 0
jne 0x4cf1df
push str.SoftwareMicrosoftTUX
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push str._sSoftwareMicrosotf
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Append
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.CLSIDF81A215D_01BF_3082_0210_999811130022
push 0x80000000
call fcn.00402a6b
add esp, 8
push 0x5b78a4
push 0x590694
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5906c8
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1340]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15e4], eax
mov eax, dword [ebp - 0x15e4]
mov dword [ebp - 0x15e8], eax
mov byte [ebp - 4], 0x45
mov ecx, dword [ebp - 0x15e8]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1340]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x1230]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x1230]
push eax
call fcn.00401fca
add esp, 4
push str.MSHTA_VBSCRIPT
lea ecx, [ebp - 0x1230]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4cf319
push str.JavaUpdateSheduller
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
test eax, eax
jne 0x4cf319
mov edx, dword [ebp - 0x414]
push edx
push 0x5b78a4
push str.Entrada_Eliminada__HKUS_s...Run___JavaUpdateSheduller___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x590740
push 0x54
push str.EnableDCOM
push str.SoftwareMicrosoftOle
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5b7db4
push str._sCtfmon.exe
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590778
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5907a8
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x5b78a4
push 0x5907b4
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5907bc
push 0x5b6504
push 0x80000003
lea ecx, [ebp - 0x1344]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15ec], eax
mov edx, dword [ebp - 0x15ec]
mov dword [ebp - 0x15f0], edx
mov byte [ebp - 4], 0x46
mov eax, dword [ebp - 0x15f0]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1344]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x5907c8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf459
push 0x5907d0
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf459
lea ecx, [ebp - 0x1230]
push ecx
push 0x54
push 0x5907e8
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
lea edx, [ebp - 0x61c]
push edx
push str..DEFAULT_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590800
push 0x5b6504
push 0x80000003
lea eax, [ebp - 0x1348]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15f4], eax
mov ecx, dword [ebp - 0x15f4]
mov dword [ebp - 0x15f8], ecx
mov byte [ebp - 4], 0x47
mov edx, dword [ebp - 0x15f8]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1348]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x59080c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf52f
push 0x590814
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf52f
lea eax, [ebp - 0x1230]
push eax
push 0x54
push 0x59082c
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
lea ecx, [ebp - 0x61c]
push ecx
push str.S_1_5_19_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590844
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x134c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x15fc], eax
mov eax, dword [ebp - 0x15fc]
mov dword [ebp - 0x1600], eax
mov byte [ebp - 4], 0x48
mov ecx, dword [ebp - 0x1600]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x590850
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf605
push 0x590858
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf605
lea edx, [ebp - 0x1230]
push edx
push 0x54
push 0x590870
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
lea eax, [ebp - 0x61c]
push eax
push str.S_1_5_20_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590888
push 0x5b6504
push 0x80000003
lea ecx, [ebp - 0x1350]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1604], eax
mov edx, dword [ebp - 0x1604]
mov dword [ebp - 0x1608], edx
mov byte [ebp - 4], 0x49
mov eax, dword [ebp - 0x1608]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1350]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x590894
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf6db
push str.SYSTEM32CTFMON.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf6db
lea ecx, [ebp - 0x1230]
push ecx
push 0x54
push str.Ctfmon.exe
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerCLSID208D2C60_3AEA_1069_A2D7_08002B30309D
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590924
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1354]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x160c], eax
mov eax, dword [ebp - 0x160c]
mov dword [ebp - 0x1610], eax
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x1610]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1354]
call sub.MFC42.DLL_CString::CString
push 0x590928
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf784
push 0x5b8e18
push 0x54
push 0x590930
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerCLSID20D04FE0_3AEA_1069_A2D8_08002B30309D
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590998
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1358]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1614], eax
mov eax, dword [ebp - 0x1614]
mov dword [ebp - 0x1618], eax
mov byte [ebp - 4], 0x4b
mov ecx, dword [ebp - 0x1618]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1358]
call sub.MFC42.DLL_CString::CString
push 0x59099c
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf82d
push 0x5b8e1c
push 0x54
push 0x5909a4
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerCLSID450D8FBA_AD25_11D0_98A8_0800361B1103
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590a0c
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x135c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x161c], eax
mov eax, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], eax
mov byte [ebp - 4], 0x4c
mov ecx, dword [ebp - 0x1620]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x135c]
call sub.MFC42.DLL_CString::CString
push 0x590a10
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf8d6
push 0x5b8e20
push 0x54
push 0x590a18
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerCLSID645FF040_5081_101B_9F08_00AA002F954E
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590a80
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1360]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1624], eax
mov eax, dword [ebp - 0x1624]
mov dword [ebp - 0x1628], eax
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp - 0x1628]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1360]
call sub.MFC42.DLL_CString::CString
push 0x590a84
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cf97f
push 0x5b8e24
push 0x54
push 0x590a8c
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsClassicStartMenu
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590ae8
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.645FF040_5081_101B_9F08_00AA002F954E
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x590bd4
lea eax, [ebp - 0x61c]
push eax
push 0x80000003
lea ecx, [ebp - 0x1364]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x162c], eax
mov edx, dword [ebp - 0x162c]
mov dword [ebp - 0x1630], edx
mov byte [ebp - 4], 0x4e
mov eax, dword [ebp - 0x1630]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1364]
call sub.MFC42.DLL_CString::CString
push 0x590be8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4cfab2
push str.LowRiskFileTypes
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
test eax, eax
jne 0x4cfab2
mov edx, dword [ebp - 0x414]
push edx
push str.Entrada_Eliminada__LowRiskFileTypes___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.batfile
push 0x54
push 0x590c38
push str..bat
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.cmdfile
push 0x54
push 0x590c4c
push str..cmd
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590c58
push 0x54
push 0x590c60
push str..com
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590c6c
push 0x54
push 0x590c74
push str..exe
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.regfile
push 0x54
push 0x590c88
push str..reg
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.VBSFile
push 0x54
push 0x590c9c
push str..vbs
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.JSFile
push 0x54
push 0x590cb0
push 0x590cb4
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590cb8
push 0x54
push 0x590cc0
push str.exefile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590ce0
push 0x54
push 0x590ce8
push str.comfile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590d08
push 0x54
push 0x590d10
push str.cmdfile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590d30
push 0x54
push 0x590d38
push str.batfile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.__1___
push 0x54
push 0x590d60
push str.piffile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.__1___S
push 0x54
push 0x590d88
push str.scrfile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.Regedit.exe___1_
push 0x54
push 0x590dbc
push str.regfile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590ddc
push 0x54
push 0x590df0
push str.txtfile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590e10
push 0x54
push 0x590e24
push str.inffile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.Notepad.exe___1_
push 0x54
push 0x590e58
push str.inifile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590e78
push 0x54
push 0x590e8c
push str.jsfile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590eac
push 0x54
push 0x590ec0
push str.vbsfile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str.WScript.exe___1___
push 0x54
push 0x590ef4
push str.vbefile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push str._SystemRoot__system32mmc.exe___1___
push 0x45
push 0x590f3c
push str.MSCFile_shellopencommand
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590f5c
push 0x590f60
push 0x80000000
lea eax, [ebp - 0x1368]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1634], eax
mov ecx, dword [ebp - 0x1634]
mov dword [ebp - 0x1638], ecx
mov byte [ebp - 4], 0x4f
mov edx, dword [ebp - 0x1638]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1368]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.CARPETA_DE_ARCHIVOS
lea eax, [ebp - 0x414]
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4cfdc0
push 0x590f7c
push 0x54
push 0x590f88
push 0x590f8c
push 0x80000000
call fcn.00402bb9
add esp, 0x14
push 0x590f94
push str.exefile
push 0x80000000
call fcn.00402ed5
add esp, 0xc
push str.NeverShowExt
push str.comfile
push 0x80000000
call fcn.00402ed5
add esp, 0xc
push 0x590fc4
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4cfe22
push 0x5b8e28
push 0x4d
push 0x590fdc
push str.SystemCurrentControlSetControlVirtualDeviceDrivers
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x591018
push 0x44
push 0x591020
push str.SoftwareMicrosoftInternet_ExplorerActiveX_Compatibility00000566_0000_0010_8000_00AA006D2EA4
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x591098
push 0x44
push 0x5910a0
push str.SoftwareMicrosoftInternet_ExplorerActiveX_Compatibility22FD7C0A_850C_4A53_9821_0B0915C96139
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x591118
push 0x44
push 0x591120
push str.SoftwareMicrosoftInternet_ExplorerActiveX_Compatibility5F810AFC_BB5F_4416_BE63_E01DD117BD6C
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x591198
push 0x44
push str.Compatibility_Flags
push str.SoftwareMicrosoftInternet_ExplorerActiveX_Compatibility0955AC62_BF2E_4CBA_A2B9_A63F772D46CF
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.SoftwarePoliciesMicrosoftWindows_NTSystemRestore
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x61c]
push edx
push 0x5b78a4
push 0x591250
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x591258
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x591264
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x591274
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x591280
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoftWindows_NTCurrentVersionSystemRestore
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push 0x5b78a4
push 0x5912cc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5912d4
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5912e0
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5912f0
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
lea edx, [ebp - 0x136c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x163c], eax
mov eax, dword [ebp - 0x163c]
mov dword [ebp - 0x1640], eax
mov byte [ebp - 4], 0x50
mov ecx, dword [ebp - 0x1640]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x136c]
call sub.MFC42.DLL_CString::CString
push 0x5912fc
lea edx, [ebp - 0x414]
push edx
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4d001f
push 0x591310
push 0x44
push 0x591314
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x591320
push 0x5b83b8
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4d0055
push 0x591338
push 0x44
push 0x59133c
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.DisableConfig
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SFCDisable
push 0x591364
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwareMicrosoft_security_center
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5913c4
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5913d8
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5913f0
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwareMicrosoft_security_center
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.UACDisableNotify
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.UpdatesDisableNotify
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.AntiVirusDisableNotify
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwarePoliciesMicrosoftWindowsWindowsUpdateAU
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5914a8
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5914b8
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwarePoliciesMicrosoftWindowsWindowsUpdateAU
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.NoAutoUpdate
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.AUOptions
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SoftwarePoliciesMicrosoftWindowsWindowsUpdate
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.DoNotAllowXPSP2
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.DoNotAllowXPSP3
push 0x5b6504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.MSVS32S.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C:AUDIODGSYS.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push str.C:RECYCLERS_1_5_21_7519231414_5162749137_7531231582_0000SYSTEM.EXE
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7778
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.K_37763_383_2847_00winsrc.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7778
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.P_7_78_8964_9648_3874wincrs.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7778
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.P_7_78_8964_9648_3874windll.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7658
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.VirusRL2009VirusRL2009.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7658
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Common_FilesSafeDrv.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ArchiverforWin.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.AudioTreiber_x64.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.EGUN.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.PowerFile.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Server.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5916cc
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Test.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Windefender.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.MicrosoftWindows_services.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
mov ecx, 0x5b7654
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.MicrosoftWindowsSVCHOST.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ADOBERU.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ADOBEPPER.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.CCAPP.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.dpserial32.exe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.EXPLORER32.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.JAVAJRE.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.JAVARUN.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.PRDRV.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5917b0
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SPOOLVS.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.WMISPRQ.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ConfigSysIEXPLORERR.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ConfigSysMEDIAPLAYER.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ConfigSysNOTEPADS.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ConfigSysNOTEPADS2.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ConfigSysSEND.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ConfigSysISP.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x59187c
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.INFOCARD.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ehomedllMEDIAPLAYER.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ehomedllNOTEPADS.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ehomedllNOTEPADS2.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ehomedllSEND.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ehomedllSRV.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SkypeIEXPLORERR.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SkypeMEDIAPLAYER.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SkypeSEND.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SunJavaDeploymentlogsIEXPLORERR.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SunJavaDeploymentlogsMEDIAPLAYER.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SunJavaDeploymentlogsSEND.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x5b7eb4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SystemSURV86.EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Client_Server_Runtime_Process
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Host_process_Windows__Rundll32.exe_
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Service_Host_Process_for_Windows
mov ecx, 0x5b5b90
call fcn.0050f680
push str.UpdateSvchost
mov ecx, 0x5b5b90
call fcn.0050f680
push str.Windows_Update_System
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4d0c0c
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4d0ca2
push 0x5b8e2c
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4d0c49
jmp 0x4d0bff
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call fcn.00402ed5
add esp, 0xc
jmp 0x4d0bff
push 0x5b78a4
push 0x591b60
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x591ba0
push 0x44
push str.HideIcons
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x591bf0
push 0x44
push str.Start_ShowMyDocs
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591c08
push 0x44
push str.Start_ShowMyPics
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591c20
push 0x44
push str.Start_ShowMyMusic
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591c38
push 0x44
push str.Start_ShowMyComputer
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591c54
push 0x44
push str.Start_ShowControlPanel
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591c70
push 0x44
push str.Start_ShowSetProgramAccessAndDefaults
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591c9c
push 0x44
push str.Start_ShowPrinters
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591cb4
push 0x44
push str.Start_ShowHelp
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591cc8
push 0x44
push str.Start_ShowSearch
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push 0x591ce0
push 0x44
push str.Start_ShowRun
push 0x5b6504
push 0x80000003
call fcn.00402bb9
add esp, 0x14
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedFolder
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x61c]
push ecx
push str._sSuperHidden
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x591d48
push 0x44
push 0x591d4c
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.ShowSuperHidden
push 0x54
push 0x591d6c
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.checkbox
push 0x54
push 0x591d84
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
lea edx, [ebp - 0x61c]
push edx
push str._sHideFileExt
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x591d9c
push 0x44
push str.UncheckedValue
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
lea eax, [ebp - 0x61c]
push eax
push str._sHiddenSHOWALL
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x591dc4
push 0x44
push str.CheckedValue
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.Hidden
push 0x54
push str.ValueName
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.radio
push 0x54
push str.Type
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x591dfc
push 0x591e0c
push 0x80000002
lea ecx, [ebp - 0x1370]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1644], eax
mov edx, dword [ebp - 0x1644]
mov dword [ebp - 0x1648], edx
mov byte [ebp - 4], 0x51
mov eax, dword [ebp - 0x1648]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1370]
call sub.MFC42.DLL_CString::CString
push 0x591e44
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d0fff
push 0x591e64
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d0fff
push str.Your_Files_are_Encrypted.
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d102d
push 0x591e98
push 0x591eac
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x591ee4
push 0x591ef4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x591f2c
push 0x591f40
push 0x80000002
lea ecx, [ebp - 0x1374]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x164c], eax
mov edx, dword [ebp - 0x164c]
mov dword [ebp - 0x1650], edx
mov byte [ebp - 4], 0x52
mov eax, dword [ebp - 0x1650]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1374]
call sub.MFC42.DLL_CString::CString
push str.YOUR_COMPANY_NETWORK_HAS_BEEN_HACKED
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d10be
push 0x591fa0
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d10ec
push 0x591fcc
push 0x591fe0
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x592018
push 0x592028
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x592060
push 0x592070
push 0x80000002
lea ecx, [ebp - 0x1378]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1654], eax
mov edx, dword [ebp - 0x1654]
mov dword [ebp - 0x1658], edx
mov byte [ebp - 4], 0x53
mov eax, dword [ebp - 0x1658]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1378]
call sub.MFC42.DLL_CString::CString
push str.Your_Network_Infected_With_BlackHunt_Ransomware_Team.
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d119b
push str.All_your_files_were_encrypted_
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d119b
push str.security849_nuke.africa
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d11c9
push str.LegalNoticeCaption
push 0x592130
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.LegalNoticeText
push 0x59217c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5921b8
push 0x5921cc
push 0x80000002
lea ecx, [ebp - 0x137c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x165c], eax
mov edx, dword [ebp - 0x165c]
mov dword [ebp - 0x1660], edx
mov byte [ebp - 4], 0x54
mov eax, dword [ebp - 0x1660]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x137c]
call sub.MFC42.DLL_CString::CString
push str.Encrypted_by_Loki_locker
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d12b4
push str.PYSA
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d12b4
push str.YOUR_COMPANY_WAS_HACKED_AND_COMPROMISED___
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d12b4
push str.you_are_infected_of_corona_virus..
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d12b4
push str.you_are_safe..
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d12e2
push str.legalnoticecaption
push 0x5922a0
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.legalnoticetext
push 0x5922ec
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.Btn_Search
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ClassicShell
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DisallowCpl
mov ecx, 0x5b5b90
call fcn.0050f680
push str.ForceActiveDesktopOn
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HideClock
mov ecx, 0x5b5b90
call fcn.0050f680
push str.HideSCAHealth
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoActiveDesktop
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoActiveDesktopChanges
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoChangeStartMenu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoClose
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoControlPanel
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoDesktop
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoDrives
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoFavoritesMenu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoFind
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoFolderOptions
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoInstrumentation
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoLogOff
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoPropertiesMyComputer
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoRecycleFiles
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoRun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoSetActiveDesktop
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoSetTaskbar
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoStartBanner
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoStartMenuMorePrograms
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoStartMenuSubFolders
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoViewContextMenu
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoWindowsUpdate
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoWinKeys
mov ecx, 0x5b5b90
call fcn.0050f680
push str.RestrictRun
mov ecx, 0x5b5b90
call fcn.0050f680
push str.SpecifyDefaultButtons
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4d14d8
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4d15a8
push 0x5b8e30
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4d1515
jmp 0x4d14c9
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x1230]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push 0x5b78a4
push 0x59255c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x1230]
push ecx
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402ed5
add esp, 0xc
jmp 0x4d14c9
lea ecx, [ebp - 0x61c]
push ecx
push 0x5b78a4
push str._s_sRestrictRun
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
lea edx, [ebp - 0x61c]
push edx
push 0x5b78a4
push str._s_sDisallowRun
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x80000003
call fcn.00402a6b
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push 0x5b78a4
push 0x59258c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.DisallowRun
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
mov ecx, 0x5b5b90
call fcn.0050f5b0
push str.DisableRegistryTools
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DisableTaskManager
mov ecx, 0x5b5b90
call fcn.0050f680
push str.DisableTaskMgr
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoColorChoice
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoDispAppearancePage
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoDispBackgroundPage
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoDispCPL
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoDispScrSavPage
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoDispSettingsPage
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoSizeChoice
mov ecx, 0x5b5b90
call fcn.0050f680
push str.NoVisualStyleChoice
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x592674
mov ecx, 0x5b5b90
call fcn.0050f680
push str.test
mov ecx, 0x5b5b90
call fcn.0050f680
push 0x592684
mov ecx, 0x5b5b90
call fcn.0050f680
mov dword [0x5b84b8], 0
jmp 0x4d1737
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov ecx, 0x5b5b90
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4d1807
push 0x5b8e34
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b90
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4d1774
jmp 0x4d1728
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b90
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x1230]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x61c]
push eax
push 0x5b78a4
push 0x5926cc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x1230]
push ecx
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
lea edx, [ebp - 0x1230]
push edx
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402ed5
add esp, 0xc
jmp 0x4d1728
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionPoliciesUninstall
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.NoAddRemovePrograms
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwarePoliciesMicrosoftWindowsSystem
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.disableCMD
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b78a4
push str._sSoftwarePoliciesMicrosoftInternet_ExplorerControl_Panel
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.GeneralTab
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.HomePage
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.SoftwarePoliciesMicrosoftInternet_ExplorerRestrictions
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x61c]
push edx
push 0x5b78a4
push 0x5927f8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x592800
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push str.NoBrowserContextMenu
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.NoPopupManagement
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.SystemCurrentControlSetServicesTcpipParameters
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x592878
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x1380]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1664], eax
mov eax, dword [ebp - 0x1664]
mov dword [ebp - 0x1668], eax
mov byte [ebp - 4], 0x55
mov ecx, dword [ebp - 0x1668]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1380]
call sub.MFC42.DLL_CString::CString
push 0x592888
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d19ca
push str._SystemRoot_System32driversetc
push 0x45
push str.DataBasePath
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5b78a4
push 0x5928c4
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5928e0
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1384]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x166c], eax
mov eax, dword [ebp - 0x166c]
mov dword [ebp - 0x1670], eax
mov byte [ebp - 4], 0x56
mov ecx, dword [ebp - 0x1670]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1384]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push str.LYCOS
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d1a82
push 0x5928f8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1b58
push str.BLPHC
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d1ac2
push str..SCR
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1b58
push str.MICROSOFTWINDOWSIEUPDATE_
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1b58
push str.BLACKSTER.SCR
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1b58
push str.HELPHOST.COM
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1b58
push str.PEYTER_MARLON.SCR
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1b58
push str.WINLOGON.SCR
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d1b6f
push str.SCRNSAVE.EXE
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x592984
lea edx, [ebp - 0x61c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5929bc
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
lea ecx, [ebp - 0x1388]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1674], eax
mov edx, dword [ebp - 0x1674]
mov dword [ebp - 0x1678], edx
mov byte [ebp - 4], 0x57
mov eax, dword [ebp - 0x1678]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1388]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x5929c4
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1c63
push str.XTGINA.DLL
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d1c63
push str.GinaDLL
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov edx, dword [ebp - 0x414]
push edx
push str.Eliminado_valor__GinaDLL_______s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x592a04
lea eax, [ebp - 0x61c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x592a3c
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
lea edx, [ebp - 0x138c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x167c], eax
mov eax, dword [ebp - 0x167c]
mov dword [ebp - 0x1680], eax
mov byte [ebp - 4], 0x58
mov ecx, dword [ebp - 0x1680]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x138c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x592a44
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1e39
push str.BCLLPS.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1df7
push str.GJNO.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1df7
push str.IGFXGUI.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1df7
push str.KYRNMY.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1df7
push str.MSUPDATE.EXE
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d1df7
push str.Taskman
lea edx, [ebp - 0x61c]
push edx
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov eax, dword [ebp - 0x414]
push eax
push str.Eliminado_valor__Taskman_______s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x592adc
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x61c]
push edx
push 0x5b78a4
push 0x592b14
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x592b1c
push 0x5b6504
push 0x80000003
lea eax, [ebp - 0x1390]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1684], eax
mov ecx, dword [ebp - 0x1684]
mov dword [ebp - 0x1688], ecx
mov byte [ebp - 4], 0x59
mov edx, dword [ebp - 0x1688]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1390]
call sub.MFC42.DLL_CString::CString
push 0x592b24
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
test eax, eax
jne 0x4d1f05
mov eax, dword [ebp - 0x414]
push eax
push str.Eliminado__Shell___HKCU_____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str..DEFAULTSoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x592b90
push 0x5b6504
push 0x80000003
lea ecx, [ebp - 0x1394]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x168c], eax
mov edx, dword [ebp - 0x168c]
mov dword [ebp - 0x1690], edx
mov byte [ebp - 4], 0x5a
mov eax, dword [ebp - 0x1690]
push eax
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1394]
call sub.MFC42.DLL_CString::CString
push 0x592b98
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
test eax, eax
jne 0x4d1fb0
mov ecx, dword [ebp - 0x414]
push ecx
push str.Eliminado__Shell___.DEFAULT_____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.S_1_5_19SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x592c08
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1398]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1694], eax
mov eax, dword [ebp - 0x1694]
mov dword [ebp - 0x1698], eax
mov byte [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x1698]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1398]
call sub.MFC42.DLL_CString::CString
push 0x592c10
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
test eax, eax
jne 0x4d205b
mov edx, dword [ebp - 0x414]
push edx
push str.Eliminado__Shell___LocalService_____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.S_1_5_20SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x592c84
push 0x5b6504
push 0x80000003
lea eax, [ebp - 0x139c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x169c], eax
mov ecx, dword [ebp - 0x169c]
mov dword [ebp - 0x16a0], ecx
mov byte [ebp - 4], 0x5c
mov edx, dword [ebp - 0x16a0]
push edx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x139c]
call sub.MFC42.DLL_CString::CString
push 0x592c8c
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
test eax, eax
jne 0x4d2106
mov eax, dword [ebp - 0x414]
push eax
push str.Eliminado__Shell___NetworkService_____s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x592cc0
lea ecx, [ebp - 0x61c]
push ecx
push 0x80000002
lea edx, [ebp - 0x13a0]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x16a4], eax
mov eax, dword [ebp - 0x16a4]
mov dword [ebp - 0x16a8], eax
mov byte [ebp - 4], 0x5d
mov ecx, dword [ebp - 0x16a8]
push ecx
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x13a0]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x414]
call sub.MFC42.DLL_CString::MakeUpper
push 0x592cc8
lea ecx, [ebp - 0x414]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4d2aa0