Function at 0x5b53ed
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x656e7f
mov eax, dword fs:[0]
push eax
mov eax, 0x1084
call fcn.00629030
mov eax, dword [0x70d514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x7139d4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x713520]
cmp eax, dword [ecx + 4]
jg 0x5b6fb5
cmp byte [0x70d26c], 0
je 0x5b6f96
lea eax, [ebp - 0x1074]
xor ebx, ebx
push eax
mov dword [ebp - 0x1074], ebx
mov dword [ebp - 0x1070], ebx
call fcn.005b3de0
mov dword [ebp - 0x1074], eax
lea ecx, [ebp - 0x810]
mov dword [ebp - 4], ebx
mov dword [esp], str.avp.exe
call fcn.00449380
mov esi, str.Kaspersky
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.avpui.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 3
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.nav.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, str.Norton
mov byte [ebp - 4], 5
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.ns.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7f8]
push esi
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.nortonsecurity.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 9
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.nswscsvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0xb
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.navapsvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0xd
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.ekrn.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, 0x665bf8
mov byte [ebp - 4], 0xf
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.egui.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x11
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.eguiproxy.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x13
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.avastsvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, str.Avast
mov byte [ebp - 4], 0x15
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.ashServ.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x17
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.mcshield.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, str.McAfee
mov byte [ebp - 4], 0x19
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.MCODS.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x1b
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.cavwp.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, str.Comodo
mov byte [ebp - 4], 0x1d
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.dragon_updater.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x1f
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.cis.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x21
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.cmdagent.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x23
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.psuamain.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, str.Panda
mov byte [ebp - 4], 0x25
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.PSUAConsole.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x27
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.AVENGINE.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x29
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.avguard.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push str.Avira
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2b
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.dwengine.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, str.DrWeb
mov byte [ebp - 4], 0x2d
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2f
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x30
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.dwantispam.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x31
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x32
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.dwservice.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x33
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x34
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.dwnetfilter.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x35
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x36
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.dwwatcher.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x37
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x38
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.avgidsagent.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, 0x665d60
mov byte [ebp - 4], 0x39
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.avgToolsSvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x3b
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.AVGUI.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x3d
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.aswEngSrv.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x3f
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x40
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.wsc_proxy.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x41
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x42
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.AVGSvc.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x43
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x44
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x7f8]
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.avgemc.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x45
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x46
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.coreserviceshell.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
mov esi, str.TrendMicro
mov byte [ebp - 4], 0x47
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x48
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.uiWatchDog.exe
lea ecx, [ebp - 0x810]
call fcn.00449380
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x49
call fcn.00449380
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x810]
call fcn.00449330
push str.Tmsalnstance64.exe
lea ecx, [ebp - 0x870]
call fcn.00449380
push esi
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0x4b
call fcn.00449380
lea eax, [ebp - 0x870]
mov byte [ebp - 4], 0x4c
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x870]
call fcn.00449330
push str.AMSPTelemetryService.exe
lea ecx, [ebp - 0x840]
call fcn.00449380
push esi
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x4d
call fcn.00449380
lea eax, [ebp - 0x840]
mov byte [ebp - 4], 0x4e
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x840]
call fcn.00449330
push str.coreFrameworkHost.exe
lea ecx, [ebp - 0x8a0]
call fcn.00449380
push esi
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0x4f
call fcn.00449380
lea eax, [ebp - 0x8a0]
mov byte [ebp - 4], 0x50
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x8a0]
call fcn.00449330
push str.ntrtscan.exe
lea ecx, [ebp - 0x9c0]
call fcn.00449380
push esi
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], 0x51
call fcn.00449380
lea eax, [ebp - 0x9c0]
mov byte [ebp - 4], 0x52
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x9c0]
call fcn.00449330
push str.tmntsrv.exe
lea ecx, [ebp - 0x9f0]
call fcn.00449380
push esi
lea ecx, [ebp - 0x9d8]
mov byte [ebp - 4], 0x53
call fcn.00449380
mov byte [ebp - 4], 0x54
lea eax, [ebp - 0x9f0]
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x9d8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x9f0]
call fcn.00449330
push str.bdagent.exe
lea ecx, [ebp - 0xa20]
call fcn.00449380
mov esi, str.BitDefender
mov byte [ebp - 4], 0x55
push esi
lea ecx, [ebp - 0xa08]
call fcn.00449380
lea eax, [ebp - 0xa20]
mov byte [ebp - 4], 0x56
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xa08]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xa20]
call fcn.00449330
push str.gziface.exe
lea ecx, [ebp - 0xa50]
call fcn.00449380
push esi
lea ecx, [ebp - 0xa38]
mov byte [ebp - 4], 0x57
call fcn.00449380
lea eax, [ebp - 0xa50]
mov byte [ebp - 4], 0x58
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xa38]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xa50]
call fcn.00449330
push str.ProductAgentService.exe
lea ecx, [ebp - 0xa80]
call fcn.00449380
push esi
lea ecx, [ebp - 0xa68]
mov byte [ebp - 4], 0x59
call fcn.00449380
lea eax, [ebp - 0xa80]
mov byte [ebp - 4], 0x5a
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xa68]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xa80]
call fcn.00449330
push str.vsservppl.exe
lea ecx, [ebp - 0xab0]
call fcn.00449380
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0xa98]
push esi
call fcn.00449380
lea eax, [ebp - 0xab0]
mov byte [ebp - 4], 0x5c
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xab0]
call fcn.00449330
push str.bdredline.exe
lea ecx, [ebp - 0xae0]
call fcn.00449380
push esi
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0x5d
call fcn.00449380
lea eax, [ebp - 0xae0]
mov byte [ebp - 4], 0x5e
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xae0]
call fcn.00449330
push str.vsserv.exe
lea ecx, [ebp - 0xb10]
call fcn.00449380
push esi
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], 0x5f
call fcn.00449380
lea eax, [ebp - 0xb10]
mov byte [ebp - 4], 0x60
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xb10]
call fcn.00449330
push str.updatesrv.exe
lea ecx, [ebp - 0xb40]
call fcn.00449380
push esi
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], 0x61
call fcn.00449380
lea eax, [ebp - 0xb40]
mov byte [ebp - 4], 0x62
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xb40]
call fcn.00449330
push str.mbamservice.exe
lea ecx, [ebp - 0xb70]
call fcn.00449380
push str.MalwareBytes
lea ecx, [ebp - 0xb58]
mov byte [ebp - 4], 0x63
call fcn.00449380
lea eax, [ebp - 0xb70]
mov byte [ebp - 4], 0x64
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xb58]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xb70]
call fcn.00449330
push str.freshclam.exe
lea ecx, [ebp - 0xba0]
call fcn.00449380
mov esi, str.Clamav
mov byte [ebp - 4], 0x65
push esi
lea ecx, [ebp - 0xb88]
call fcn.00449380
lea eax, [ebp - 0xba0]
mov byte [ebp - 4], 0x66
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xb88]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xba0]
call fcn.00449330
push str.freshclamwrap.exe
lea ecx, [ebp - 0x990]
call fcn.00449380
push esi
lea ecx, [ebp - 0x978]
mov byte [ebp - 4], 0x67
call fcn.00449380
lea eax, [ebp - 0x990]
mov byte [ebp - 4], 0x68
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x978]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x990]
call fcn.00449330
push str.gdscan.exe
lea ecx, [ebp - 0xc00]
call fcn.00449380
push str.GData
lea ecx, [ebp - 0xbe8]
mov byte [ebp - 4], 0x69
call fcn.00449380
lea eax, [ebp - 0xc00]
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xbe8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xc00]
call fcn.00449330
push str.a2start.exe
lea ecx, [ebp - 0xc30]
call fcn.00449380
push str.Emsisoft
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], 0x6b
call fcn.00449380
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 0x6c
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xc30]
call fcn.00449330
push str.k7tsecurity.exe
lea ecx, [ebp - 0xc60]
call fcn.00449380
mov esi, 0x665f44
mov byte [ebp - 4], 0x6d
push esi
lea ecx, [ebp - 0xc48]
call fcn.00449380
lea eax, [ebp - 0xc60]
mov byte [ebp - 4], 0x6e
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xc48]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xc60]
call fcn.00449330
push str.k7tsmain.exe
lea ecx, [ebp - 0xc90]
call fcn.00449380
push esi
lea ecx, [ebp - 0xc78]
mov byte [ebp - 4], 0x6f
call fcn.00449380
lea eax, [ebp - 0xc90]
mov byte [ebp - 4], 0x70
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xc78]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xc90]
call fcn.00449330
push str.tpeasy.exe
lea ecx, [ebp - 0xcc0]
call fcn.00449380
push str.TrustPort
lea ecx, [ebp - 0xca8]
mov byte [ebp - 4], 0x71
call fcn.00449380
lea eax, [ebp - 0xcc0]
mov byte [ebp - 4], 0x72
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xca8]
call fcn.00449330
lea ecx, [ebp - 0xcc0]
call fcn.00449330
push str.vipreui.exe
lea ecx, [ebp - 0xcf0]
call fcn.00449380
push str.Vipre
lea ecx, [ebp - 0xcd8]
mov byte [ebp - 4], 0x73
call fcn.00449380
lea eax, [ebp - 0xcf0]
mov byte [ebp - 4], 0x74
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xcd8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xcf0]
call fcn.00449330
push str.avkwctl.exe
lea ecx, [ebp - 0xd20]
call fcn.00449380
push str.MicroWorld
lea ecx, [ebp - 0xd08]
mov byte [ebp - 4], 0x75
call fcn.00449380
lea eax, [ebp - 0xd20]
mov byte [ebp - 4], 0x76
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xd08]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xd20]
call fcn.00449330
push str.fsav32.exe
lea ecx, [ebp - 0xd50]
call fcn.00449380
push str.FSecure
lea ecx, [ebp - 0xd38]
mov byte [ebp - 4], 0x77
call fcn.00449380
lea eax, [ebp - 0xd50]
mov byte [ebp - 4], 0x78
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xd38]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xd50]
call fcn.00449330
push str.qhactivedefense.exe
lea ecx, [ebp - 0xd80]
call fcn.00449380
mov esi, str.Q360
mov byte [ebp - 4], 0x79
push esi
lea ecx, [ebp - 0xd68]
call fcn.00449380
lea eax, [ebp - 0xd80]
mov byte [ebp - 4], 0x7a
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xd68]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xd80]
call fcn.00449330
push str.qhsafetray.exe
lea ecx, [ebp - 0xdb0]
call fcn.00449380
push esi
lea ecx, [ebp - 0xd98]
mov byte [ebp - 4], 0x7b
call fcn.00449380
lea eax, [ebp - 0xdb0]
mov byte [ebp - 4], 0x7c
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xd98]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xdb0]
call fcn.00449330
push str.qhwatchdog.exe
lea ecx, [ebp - 0xbd0]
call fcn.00449380
push esi
lea ecx, [ebp - 0xbb8]
mov byte [ebp - 4], 0x7d
call fcn.00449380
lea eax, [ebp - 0xbd0]
mov byte [ebp - 4], 0x7e
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xbb8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xbd0]
call fcn.00449330
push str.liveupdate360.exe
lea ecx, [ebp - 0xde0]
call fcn.00449380
push esi
lea ecx, [ebp - 0xdc8]
mov byte [ebp - 4], 0x7f
call fcn.00449380
lea eax, [ebp - 0xde0]
mov byte [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xdc8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xde0]
call fcn.00449330
push str.360tsliveupd.exe
lea ecx, [ebp - 0xe10]
call fcn.00449380
push esi
lea ecx, [ebp - 0xdf8]
mov byte [ebp - 4], 0x81
call fcn.00449380
mov byte [ebp - 4], 0x82
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xdf8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0xe10]
call fcn.00449330
push str.adblockerultimategui.exe
lea ecx, [ebp - 0x8d0]
call fcn.00449380
push str.AdBlocker
lea ecx, [ebp - 0x8b8]
mov byte [ebp - 4], 0x83
call fcn.00449380
lea eax, [ebp - 0x8d0]
mov byte [ebp - 4], 0x84
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x8b8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x8d0]
call fcn.00449330
push str.adlock.exe
lea ecx, [ebp - 0x900]
call fcn.00449380
push str.AdLock
lea ecx, [ebp - 0x8e8]
mov byte [ebp - 4], 0x85
call fcn.00449380
lea eax, [ebp - 0x900]
mov byte [ebp - 4], 0x86
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x8e8]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x900]
call fcn.00449330
push str.ghostery_midnight.exe
lea ecx, [ebp - 0x960]
call fcn.00449380
push str.Ghostery
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], 0x87
call fcn.00449380
lea eax, [ebp - 0x960]
mov byte [ebp - 4], 0x88
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x960]
call fcn.00449330
push str.msmpeng.exe
lea ecx, [ebp - 0x930]
call fcn.00449380
mov esi, str.Microsoft
mov byte [ebp - 4], 0x89
push esi
lea ecx, [ebp - 0x918]
call fcn.00449380
lea eax, [ebp - 0x930]
mov byte [ebp - 4], 0x8a
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], bl
call fcn.00449330
lea ecx, [ebp - 0x930]
call fcn.00449330
push str.msseces.exe
lea ecx, [ebp - 0xe40]
call fcn.00449380
push esi
lea ecx, [ebp - 0xe28]
mov byte [ebp - 4], 0x8b
call fcn.00449380
lea eax, [ebp - 0xe40]
mov byte [ebp - 4], 0x8c
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1074]
call fcn.005b3e89
lea ecx, [ebp - 0xe40]
mov byte [ebp - 4], bl
call fcn.005b4701
push ebx
push 2
mov dword [ebp - 0x106c], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x1084], eax
test eax, eax
je 0x5b6f8a
lea ecx, [ebp - 0x106c]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5b6f8a
push 0x3e8
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.00634997
add esp, 0xc
lea eax, [ebp - 0x7e0]
lea ecx, [ebp - 0x7f8]
push eax
call fcn.00449380
cmp dword [ebp - 0x7e4], 0x10
lea eax, [ebp - 0x1080]
lea edi, [ebp - 0x7f8]
mov byte [ebp - 4], 0x8d
cmovae edi, dword [ebp - 0x7f8]
lea esi, [ebp - 0x7f8]
cmovae esi, dword [ebp - 0x7f8]
lea ecx, [ebp - 0x7f8]
push eax
call fcn.005b5133
push fcn.00634ab5
push edi
push dword [eax]
lea eax, [ebp - 0x1088]
push esi
push eax
call fcn.005b42c5
mov eax, dword [ebp - 0x1074]
add esp, 0x14
mov esi, dword [eax]
mov dword [ebp - 0x1080], esi
cmp esi, eax
je 0x5b6f33
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x828]
call fcn.005b448a
cmp dword [ebp - 0x814], 0x10
lea eax, [ebp - 0x1088]
lea ebx, [ebp - 0x828]
mov byte [ebp - 4], 0x8e
cmovae ebx, dword [ebp - 0x828]
lea edi, [ebp - 0x828]
cmovae edi, dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
push eax
call fcn.005b5133
push fcn.00634ab5
push ebx
push dword [eax]
lea eax, [ebp - 0x108c]
push edi
push eax
call fcn.005b42c5
add esp, 0x14
lea eax, [ebp - 0x7f8]
lea ecx, [ebp - 0x828]
push eax
call fcn.005a7c64
test al, al
jne 0x5b6dcd
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x8d
call fcn.00449330
lea ecx, [ebp - 0x1080]
call fcn.005b4727
mov esi, dword [ebp - 0x1080]
cmp esi, dword [ebp - 0x1074]
jne 0x5b6d28
jmp 0x5b6f33
push dword [ebp - 0x1084]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x28
mov ecx, 0x70d270
push esi
call fcn.00449300
lea ecx, [ebp - 0x828]
jmp 0x5b6f7a
push 0x3e8
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x3f8]
push eax
call fcn.00634997
add esp, 0xc
lea eax, [ebp - 0x3f8]
lea ecx, [ebp - 0x858]
push eax
call fcn.00449380
cmp dword [ebp - 0x844], 0x10
lea eax, [ebp - 0x108c]
lea edi, [ebp - 0x858]
mov byte [ebp - 4], 0x8f
cmovae edi, dword [ebp - 0x858]
lea esi, [ebp - 0x858]
cmovae esi, dword [ebp - 0x858]
lea ecx, [ebp - 0x858]
push eax
call fcn.005b5133
push fcn.00634ab5
push edi
push dword [eax]
lea eax, [ebp - 0x1088]
push esi
push eax
call fcn.005b42c5
mov eax, dword [ebp - 0x1074]
add esp, 0x14
mov esi, dword [eax]
mov dword [ebp - 0x1080], esi
cmp esi, eax
je 0x5b6f24
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x828]
call fcn.005b448a
cmp dword [ebp - 0x814], 0x10
lea eax, [ebp - 0x1090]
lea ebx, [ebp - 0x828]
mov byte [ebp - 4], 0x90
cmovae ebx, dword [ebp - 0x828]
lea edi, [ebp - 0x828]
cmovae edi, dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
push eax
call fcn.005b5133
push fcn.00634ab5
push ebx
push dword [eax]
lea eax, [ebp - 0x1078]
push edi
push eax
call fcn.005b42c5
add esp, 0x14
lea eax, [ebp - 0x858]
lea ecx, [ebp - 0x828]
push eax
call fcn.005a7c64
test al, al
jne 0x5b6f4f
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x8f
call fcn.00449330
lea ecx, [ebp - 0x1080]
call fcn.005b4727
mov esi, dword [ebp - 0x1080]
cmp esi, dword [ebp - 0x1074]
jne 0x5b6e84
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0x8d
call fcn.00449330
lea eax, [ebp - 0x106c]
push eax
push dword [ebp - 0x1084]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5b6df2
jmp 0x5b6f7f
push dword [ebp - 0x1084]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x28
mov ecx, 0x70d270
push esi
call fcn.00449300
lea ecx, [ebp - 0x828]
call fcn.00449330
lea ecx, [ebp - 0x858]
call fcn.00449330
lea ecx, [ebp - 0x7f8]
call fcn.00449330
lea ecx, [ebp - 0x1074]
push ecx
call fcn.005b3f34
mov eax, 0x70d270
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00628f0a
leave
ret
mov esi, 0x713520
push esi
call fcn.006291ba
cmp dword [0x713520], 0xffffffff
pop ecx
jne 0x5b543f
push 0x65bd50
call fcn.006295ef
push esi
call fcn.00629170
pop ecx
pop ecx
jmp 0x5b543f