Function at 0x446010
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59a57e
mov eax, dword fs:[0]
push eax
sub esp, 0xe28
mov eax, dword [0x6214e0]
xor eax, esp
mov dword [esp + 0xe20], eax
push ebx
push esi
push edi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0xe38]
mov dword fs:[0], eax
xor ebx, ebx
test byte [0x621cd0], 1
mov edi, 0xf
jne 0x446086
or dword [0x621cd0], 1
push 0x59f360
mov dword [0x621ccc], edi
mov dword [0x621cc8], ebx
mov byte [0x621cb8], bl
call fcn.0059000d
add esp, 4
cmp byte [0x6197f5], bl
je 0x44984b
lea eax, [esp + 0x7b]
push eax
lea ecx, [esp + 0x7f]
push ecx
lea ecx, [esp + 0x60]
call fcn.0044ae20
push 9
push str.Kaspersky
lea ecx, [esp + 0x3e0]
mov dword [esp + 0xe48], ebx
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 7
push str.avp.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 1
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 2
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 3
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 4
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
mov esi, 0x10
cmp dword [esp + 0x3d4], esi
jb 0x446185
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4461ba
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 9
push str.Kaspersky
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 9
push str.avpui.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 5
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 6
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 7
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 8
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x44628e
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4462c3
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 6
push str.Norton
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 7
push str.nav.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 9
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0xa
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0xb
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xc
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x446397
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4463cc
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 6
push str.Norton
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 6
push str.ns.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0xd
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0xe
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0xf
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x10
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4464a0
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4464d5
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 6
push str.Norton
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 0x12
push str.nortonsecurity.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x11
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x12
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x13
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x14
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4465a9
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4465de
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 6
push str.Norton
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 0xc
push str.nswscsvc.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x15
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x16
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x17
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x18
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4466b2
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4466e7
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 3
push 0x5a5344
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 8
push str.ekrn.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x19
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x1a
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x1b
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x1c
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4467bb
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4467f0
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 3
push 0x5a5344
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 8
push str.egui.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x1d
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x1e
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x1f
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x20
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4468c4
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4468f9
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 3
push 0x5a5344
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bc40
push 0xd
push str.eguiproxy.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x21
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bc40
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x22
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x23
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x24
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4469cd
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446a02
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.Avast
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.avastsvc.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x25
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x26
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x27
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x28
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x446aa8
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446add
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.McAfee
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.mcshield.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x29
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x2a
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x2b
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x2c
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x446b83
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446bb8
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.Comodo
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.cavwp.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x2d
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x2e
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x2f
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x30
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x446c5e
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446c93
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.Comodo
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.dragon_updater.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x31
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x32
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x33
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x34
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x446d39
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446d6e
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.Comodo
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.cis.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x35
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x36
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x37
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x38
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x446e14
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446e49
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.Comodo
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.cmdagent.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x39
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x3a
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x3b
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x3c
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x446eef
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446f24
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.Panda
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.psuamain.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x3d
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x3e
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x3f
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x40
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x446fca
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446fff
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.Panda
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.PSUAConsole.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x41
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x42
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x43
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x44
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4470a5
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4470da
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.Avira
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.avguard.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x45
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x46
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x47
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x48
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447180
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4471b5
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.dwengine.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x49
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x4a
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x4b
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x4c
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x44725b
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447290
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.dwarkdaemon.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x4d
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x4e
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x4f
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x50
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447336
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44736b
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.dwantispam.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x51
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x52
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x53
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x54
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447411
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447446
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.dwservice.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x55
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x56
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x57
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x58
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4474ec
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447521
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.dwnetfilter.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x59
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x5a
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x5b
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x5c
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4475c7
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4475fc
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.dwwatcher.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x5d
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x5e
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x5f
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x60
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x4476a2
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4476d7
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 0x5a5204
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.avgidsagent.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x61
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x62
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x63
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x64
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x44777d
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4477b2
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 0x5a5204
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.avgToolsSvc.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x65
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x66
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x67
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x68
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447858
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44788d
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 0x5a5204
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.AVGUI.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x69
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x6a
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x6b
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x6c
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447933
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447968
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 0x5a5204
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.aswEngSrv.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x6d
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x6e
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x6f
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x70
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447a0e
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447a43
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 0x5a5204
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.wsc_proxy.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x71
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x72
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x73
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x74
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447ae9
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447b1e
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push 0x5a5204
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.AVGSvc.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x75
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x76
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x77
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x78
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447bc4
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447bf9
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.coreserviceshell.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x79
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x7a
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x7b
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x7c
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447c9f
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447cd4
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.uiWatchDog.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x7d
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x7e
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x7f
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x80
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447d7a
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447daf
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.Tmsalnstance64.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x81
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x82
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x83
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x84
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447e55
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447e8a
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.AMSPTelemetryService.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x85
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x86
call fcn.0044a680
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x87
call fcn.0044a9b0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x88
call fcn.0044bdd0
lea ecx, [esp + 0x7c]
call fcn.0046b7f0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
cmp dword [esp + 0x3d4], esi
jb 0x447f30
mov eax, dword [esp + 0x3c0]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447f65
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c130
push str.coreFrameworkHost.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x89
call fcn.0040c130
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x8a
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x8b
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x8c
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x3bc]
call fcn.004639d0
lea ecx, [esp + 0x3d8]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.BitDefender
lea ecx, [esp + 0x414]
call fcn.0040c130
push str.bdagent.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x8d
call fcn.0040c130
lea eax, [esp + 0x410]
push eax
lea ecx, [esp + 0x3c0]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x8e
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x8f
call fcn.0044a9b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x90
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x3bc]
call fcn.004639d0
lea ecx, [esp + 0x410]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.BitDefender
lea ecx, [esp + 0x3f8]
call fcn.0040c130
mov byte [esp + 0xe40], 0x91
push str.gziface.exe
lea ecx, [esp + 0x3c0]
call fcn.0040c130
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x3c0]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x92
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x93
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x94
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x3bc]
call fcn.004639d0
lea ecx, [esp + 0x3f4]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.BitDefender
lea ecx, [esp + 0x348]
call fcn.0040c130
push str.ProductAgentService.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x95
call fcn.0040c130
lea edx, [esp + 0x344]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x96
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x97
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x98
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x3bc]
call fcn.004639d0
lea ecx, [esp + 0x344]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.BitDefender
lea ecx, [esp + 0x188]
call fcn.0040c130
push str.vsservppl.exe
lea ecx, [esp + 0x348]
mov byte [esp + 0xe44], 0x99
call fcn.0040c130
mov byte [esp + 0xe40], 0x9a
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x348]
push ecx
lea ecx, [esp + 0xd0]
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x9b
call fcn.0044a9b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x9c
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x344]
call fcn.004639d0
lea ecx, [esp + 0x184]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.BitDefender
lea ecx, [esp + 0x310]
call fcn.0040c130
push str.bdredline.exe
lea ecx, [esp + 0x188]
mov byte [esp + 0xe44], 0x9d
call fcn.0040c130
lea ecx, [esp + 0x30c]
push ecx
lea edx, [esp + 0x188]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x9e
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x9f
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xa0
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x184]
call fcn.004639d0
lea ecx, [esp + 0x30c]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.BitDefender
lea ecx, [esp + 0x1c0]
call fcn.0040c130
push str.vsserv.exe
lea ecx, [esp + 0x310]
mov byte [esp + 0xe44], 0xa1
call fcn.0040c130
lea edx, [esp + 0x1bc]
push edx
lea eax, [esp + 0x310]
mov byte [esp + 0xe44], 0xa2
push eax
lea ecx, [esp + 0xd0]
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xa3
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xa4
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x30c]
call fcn.004639d0
lea ecx, [esp + 0x1bc]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.BitDefender
lea ecx, [esp + 0x380]
call fcn.0040c130
push str.updatesrv.exe
lea ecx, [esp + 0x1c0]
mov byte [esp + 0xe44], 0xa5
call fcn.0040c130
lea eax, [esp + 0x37c]
push eax
lea ecx, [esp + 0x1c0]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xa6
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xa7
call fcn.0044a9b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xa8
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x1bc]
call fcn.004639d0
lea ecx, [esp + 0x37c]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.MalwareBytes
lea ecx, [esp + 0x1f8]
call fcn.0040c130
push str.mbamservice.exe
lea ecx, [esp + 0x380]
mov byte [esp + 0xe44], 0xa9
call fcn.0040c130
lea ecx, [esp + 0x1f4]
push ecx
lea edx, [esp + 0x380]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xaa
call fcn.0044a680
mov byte [esp + 0xe40], 0xab
push eax
lea ecx, [esp + 0x24]
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xac
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x37c]
call fcn.004639d0
lea ecx, [esp + 0x1f4]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Clamav
lea ecx, [esp + 0x134]
call fcn.0040c130
push str.freshclam.exe
lea ecx, [esp + 0x1f8]
mov byte [esp + 0xe44], 0xad
call fcn.0040c130
lea edx, [esp + 0x130]
push edx
lea eax, [esp + 0x1f8]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xae
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xaf
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xb0
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x1f4]
call fcn.004639d0
lea ecx, [esp + 0x130]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Clamav
lea ecx, [esp + 0x230]
call fcn.0040c130
push str.freshclamwrap.exe
lea ecx, [esp + 0x134]
mov byte [esp + 0xe44], 0xb1
call fcn.0040c130
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x134]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xb2
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xb3
call fcn.0044a9b0
lea edx, [esp + 0x20]
mov byte [esp + 0xe40], 0xb4
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x130]
call fcn.004639d0
lea ecx, [esp + 0x22c]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.GData
lea ecx, [esp + 0x364]
call fcn.0040c130
push str.gdscan.exe
lea ecx, [esp + 0x230]
mov byte [esp + 0xe44], 0xb5
call fcn.0040c130
lea ecx, [esp + 0x360]
push ecx
lea edx, [esp + 0x230]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xb6
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xb7
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xb8
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x22c]
call fcn.004639d0
lea ecx, [esp + 0x360]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Emsisoft
lea ecx, [esp + 0x268]
call fcn.0040c130
push str.a2start.exe
lea ecx, [esp + 0x364]
mov byte [esp + 0xe44], 0xb9
call fcn.0040c130
lea edx, [esp + 0x264]
push edx
lea eax, [esp + 0x364]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xba
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xbb
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xbc
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x360]
call fcn.004639d0
lea ecx, [esp + 0x264]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push 0x5a503c
lea ecx, [esp + 0x39c]
call fcn.0040c130
push str.k7tsecurity.exe
lea ecx, [esp + 0x268]
mov byte [esp + 0xe44], 0xbd
call fcn.0040c130
lea eax, [esp + 0x398]
push eax
lea ecx, [esp + 0x268]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xbe
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xbf
call fcn.0044a9b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xc0
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x264]
call fcn.004639d0
lea ecx, [esp + 0x398]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push 0x5a503c
lea ecx, [esp + 0x2a0]
call fcn.0040c130
push str.k7tsmain.exe
lea ecx, [esp + 0x39c]
mov byte [esp + 0xe44], 0xc1
call fcn.0040c130
lea ecx, [esp + 0x29c]
push ecx
lea edx, [esp + 0x39c]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xc2
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xc3
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xc4
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x398]
call fcn.004639d0
lea ecx, [esp + 0x29c]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.TrustPort
lea ecx, [esp + 0x32c]
call fcn.0040c130
push str.tpeasy.exe
lea ecx, [esp + 0x2a0]
mov byte [esp + 0xe44], 0xc5
call fcn.0040c130
lea edx, [esp + 0x328]
push edx
lea eax, [esp + 0x2a0]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xc6
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xc7
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xc8
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x29c]
call fcn.004639d0
lea ecx, [esp + 0x328]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Vipre
lea ecx, [esp + 0x2d8]
call fcn.0040c130
push str.vipreui.exe
lea ecx, [esp + 0x32c]
mov byte [esp + 0xe44], 0xc9
call fcn.0040c130
lea eax, [esp + 0x2d4]
push eax
lea ecx, [esp + 0x32c]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xca
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xcb
call fcn.0044a9b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xcc
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x328]
call fcn.004639d0
lea ecx, [esp + 0x2d4]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Q360
lea ecx, [esp + 0x150]
call fcn.0040c130
push str.qhactivedefense.exe
lea ecx, [esp + 0x2d8]
mov byte [esp + 0xe44], 0xcd
call fcn.0040c130
lea ecx, [esp + 0x14c]
push ecx
lea edx, [esp + 0x2d8]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xce
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xcf
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xd0
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x2d4]
call fcn.004639d0
lea ecx, [esp + 0x14c]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Q360
lea ecx, [esp + 0x16c]
call fcn.0040c130
push str.qhsafetray.exe
lea ecx, [esp + 0x150]
mov byte [esp + 0xe44], 0xd1
call fcn.0040c130
lea edx, [esp + 0x168]
push edx
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xd2
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xd3
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xd4
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x14c]
call fcn.004639d0
lea ecx, [esp + 0x168]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Q360
lea ecx, [esp + 0x1a4]
call fcn.0040c130
mov byte [esp + 0xe40], 0xd5
push str.qhwatchdog.exe
lea ecx, [esp + 0x16c]
call fcn.0040c130
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x16c]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xd6
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xd7
call fcn.0044a9b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xd8
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x168]
call fcn.004639d0
lea ecx, [esp + 0x1a0]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Q360
lea ecx, [esp + 0x1dc]
call fcn.0040c130
push str.liveupdate360.exe
lea ecx, [esp + 0x1a4]
mov byte [esp + 0xe44], 0xd9
call fcn.0040c130
lea ecx, [esp + 0x1d8]
push ecx
lea edx, [esp + 0x1a4]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xda
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xdb
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xdc
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x1a0]
call fcn.004639d0
lea ecx, [esp + 0x1d8]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Q360
lea ecx, [esp + 0x214]
call fcn.0040c130
push str.360tsliveupd.exe
lea ecx, [esp + 0x1dc]
mov byte [esp + 0xe44], 0xdd
call fcn.0040c130
lea edx, [esp + 0x210]
mov byte [esp + 0xe40], 0xde
push edx
lea eax, [esp + 0x1dc]
push eax
lea ecx, [esp + 0xd0]
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xdf
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xe0
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x1d8]
call fcn.004639d0
lea ecx, [esp + 0x210]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.AdBlocker
lea ecx, [esp + 0x24c]
call fcn.0040c130
push str.adblockerultimategui.exe
lea ecx, [esp + 0x214]
mov byte [esp + 0xe44], 0xe1
call fcn.0040c130
lea eax, [esp + 0x248]
push eax
lea ecx, [esp + 0x214]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xe2
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xe3
call fcn.0044a9b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xe4
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x210]
call fcn.004639d0
lea ecx, [esp + 0x248]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.AdLock
lea ecx, [esp + 0x284]
call fcn.0040c130
push str.adlock.exe
lea ecx, [esp + 0x24c]
mov byte [esp + 0xe44], 0xe5
call fcn.0040c130
lea ecx, [esp + 0x280]
push ecx
lea edx, [esp + 0x24c]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xe6
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xe7
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xe8
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x248]
call fcn.004639d0
lea ecx, [esp + 0x280]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Ghostery
lea ecx, [esp + 0x2bc]
call fcn.0040c130
push str.ghostery_midnight.exe
lea ecx, [esp + 0x284]
mov byte [esp + 0xe44], 0xe9
call fcn.0040c130
lea edx, [esp + 0x2b8]
push edx
lea eax, [esp + 0x284]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xea
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xeb
call fcn.0044a9b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xec
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x280]
call fcn.004639d0
lea ecx, [esp + 0x2b8]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Microsoft
lea ecx, [esp + 0x2f4]
call fcn.0040c130
push str.msmpeng.exe
lea ecx, [esp + 0x2bc]
mov byte [esp + 0xe44], 0xed
call fcn.0040c130
lea eax, [esp + 0x2f0]
push eax
lea ecx, [esp + 0x2bc]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xee
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xef
call fcn.0044a9b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xf0
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x2b8]
call fcn.004639d0
lea ecx, [esp + 0x2f0]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push str.Microsoft
lea ecx, [esp + 0x80]
call fcn.0040c130
push str.msseces.exe
lea ecx, [esp + 0x2f4]
mov byte [esp + 0xe44], 0xf1
call fcn.0040c130
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x2f4]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xf2
call fcn.0044a680
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xf3
call fcn.0044a9b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xf4
call fcn.0044bdd0
lea ecx, [esp + 0x20]
call fcn.0046b7f0
lea ecx, [esp + 0xc8]
call fcn.0046b7f0
lea ecx, [esp + 0x2f0]
call fcn.004639d0
lea ecx, [esp + 0x7c]
mov byte [esp + 0xe40], bl
call fcn.004639d0
push ebx
push 2
mov dword [esp + 0x434], 0x22c
call fcn.0058edb2
mov dword [esp + 0xbc], eax
cmp eax, ebx
je 0x449837
lea edx, [esp + 0x42c]
push edx
push eax
call fcn.0058edac
test eax, eax
je 0x449837
push 0x3e8
lea eax, [esp + 0x454]
push eax
lea ecx, [esp + 0x664]
push ecx
call fcn.005900dc
add esp, 0xc
lea edx, [esp + 0x65c]
push edx
lea ecx, [esp + 0x3dc]
call fcn.0040c130
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x3dc]
mov byte [esp + 0xe44], 0xf5
call fcn.00418a10
lea ecx, [esp + 0x110]
push ecx
lea ecx, [esp + 0x3dc]
mov edi, eax
call fcn.00418a50
lea edx, [esp + 0x108]
push edx
lea ecx, [esp + 0x3dc]
mov dword [esp + 0xc4], eax
call fcn.00418a10
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push fcn.005900ee
push ecx
mov ecx, dword [esp + 0xc8]
push edx
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x13c]
push ecx
call fcn.0044a4a0
mov edx, dword [esp + 0x90]
mov eax, dword [edx]
mov ecx, dword [esp + 0x78]
add esp, 0x20
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb4], ecx
jmp 0x4492e0
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0xc0]
push ecx
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc8], edx
mov dword [esp + 0xc4], eax
call fcn.0046b5f0
test al, al
je 0x449467
lea ecx, [esp + 0xb4]
call fcn.0044a000
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x3c8]
mov dword [esp + 0x3e0], 0xf
mov dword [esp + 0x3dc], ebx
mov byte [esp + 0x3cc], bl
call fcn.0040ba20
mov eax, dword [esp + 0x3c0]
mov byte [esp + 0xe40], 0xf6
cmp dword [esp + 0x3d4], esi
jae 0x449366
lea eax, [esp + 0x3c0]
mov edx, dword [esp + 0x3d0]
lea ecx, [esp + 0x3bc]
push ecx
add eax, edx
push eax
lea ecx, [esp + 0x108]
call fcn.00418120
lea edx, [esp + 0x118]
push edx
lea ecx, [esp + 0x3c0]
call fcn.00418a10
mov edi, eax
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x3c0]
call fcn.00418a10
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push fcn.005900ee
push ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x124]
push eax
call fcn.0044a4a0
lea ecx, [esp + 0x3f8]
push ecx
lea edx, [esp + 0x3e0]
push edx
call fcn.0040b300
add esp, 0x28
test al, al
jne 0x44941f
lea ecx, [esp + 0x3bc]
mov byte [esp + 0xe40], 0xf5
call fcn.004639d0
lea ecx, [esp + 0xb4]
call fcn.00435c60
jmp 0x4492e0
mov eax, dword [esp + 0xbc]
push eax
call dword [0x5a02e8]
lea ecx, [esp + 0xb4]
call fcn.0044a000
push 0xffffffffffffffff
add eax, 0x1c
push ebx
push eax
mov ecx, 0x621cb4
call fcn.0040ba20
lea ecx, [esp + 0x3bc]
call fcn.004639d0
lea ecx, [esp + 0x3d8]
call fcn.004639d0
jmp 0x449837
mov edx, dword [esp + 0xbc]
lea ecx, [esp + 0x42c]
push ecx
push edx
call fcn.0058eda6
test eax, eax
je 0x449805
jmp 0x449490
push 0x3e8
lea eax, [esp + 0x454]
push eax
lea ecx, [esp + 0xa4c]
push ecx
call fcn.005900dc
add esp, 0xc
lea edx, [esp + 0xa44]
push edx
lea ecx, [esp + 0x414]
call fcn.0040c130
mov eax, dword [esp + 0x414]
mov byte [esp + 0xe40], 0xf7
cmp dword [esp + 0x428], esi
jae 0x4494e0
lea eax, [esp + 0x414]
lea ecx, [esp + 0x410]
push ecx
push eax
lea ecx, [esp + 0x108]
call fcn.00418120
mov eax, dword [esp + 0x414]
cmp dword [esp + 0x428], esi
jae 0x44950c
lea eax, [esp + 0x414]
mov edx, dword [esp + 0x424]
lea ecx, [esp + 0x410]
push ecx
add eax, edx
push eax
lea ecx, [esp + 0x130]
call fcn.00418120
mov eax, dword [esp + 0x414]
cmp dword [esp + 0x428], esi
jae 0x449541
lea eax, [esp + 0x414]
lea edx, [esp + 0x410]
push edx
push eax
lea ecx, [esp + 0x128]
call fcn.00418120
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0x12c]
push fcn.005900ee
push eax
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x130]
push edx
mov edx, dword [esp + 0x130]
push eax
push ecx
push edx
lea eax, [esp + 0x3d0]
push eax
call fcn.0044a4a0
mov ecx, dword [esp + 0x90]
mov edx, dword [ecx]
mov eax, dword [esp + 0x78]
add esp, 0x20
mov dword [esp + 0xb8], edx
mov dword [esp + 0xb4], eax
jmp 0x4495c0
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0x70]
cmp eax, ebx
je 0x4495d5
cmp eax, dword [esp + 0x58]
je 0x4495e1
call fcn.0058fce6
mov eax, dword [esp + 0xb4]
cmp dword [esp + 0xb8], edi
je 0x4497ae
cmp eax, ebx
jne 0x4497a7
call fcn.0058fce6
xor eax, eax
mov ecx, dword [esp + 0xb8]
cmp ecx, dword [eax + 0x18]
jne 0x44960e
call fcn.0058fce6
mov edi, dword [esp + 0xb8]
push 0xffffffffffffffff
lea eax, [edi + 0xc]
push ebx
push eax
lea ecx, [esp + 0x400]
mov dword [esp + 0x418], 0xf
mov dword [esp + 0x414], ebx
mov byte [esp + 0x404], bl
call fcn.0040ba20
mov eax, dword [esp + 0x3f8]
mov byte [esp + 0xe40], 0xf8
cmp dword [esp + 0x40c], esi
jae 0x449660
lea eax, [esp + 0x3f8]
lea edx, [esp + 0x3f4]
push edx
push eax
lea ecx, [esp + 0x110]
call fcn.00418120
mov eax, dword [esp + 0x3f8]
cmp dword [esp + 0x40c], esi
jae 0x44968c
lea eax, [esp + 0x3f8]
mov ecx, dword [esp + 0x408]
lea edx, [esp + 0x3f4]
add eax, ecx
push edx
push eax
lea ecx, [esp + 0x118]
call fcn.00418120
mov eax, dword [esp + 0x3f8]
cmp dword [esp + 0x40c], esi
jae 0x4496c1
lea eax, [esp + 0x3f8]
lea ecx, [esp + 0x3f4]
push ecx
push eax
lea ecx, [esp + 0x120]
call fcn.00418120
mov ecx, dword [esp + 0x10c]
mov byte [esp + 0xc0], bl
mov edx, dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
push edx
mov edx, dword [esp + 0x10c]
push eax
mov eax, dword [esp + 0x11c]
push fcn.005900ee
push ecx
mov ecx, dword [esp + 0x12c]
push edx
push eax
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.0044a320
mov eax, dword [esp + 0x434]
add esp, 0x20
cmp dword [esp + 0x428], esi
jae 0x449736
lea eax, [esp + 0x414]
mov ecx, dword [esp + 0x424]
mov edx, dword [esp + 0x408]
push ecx
push eax
push edx
push ebx
lea ecx, [esp + 0x404]
call fcn.0040a680
test eax, eax
je 0x449874
mov byte [esp + 0xe40], 0xf7
cmp dword [esp + 0x40c], esi
jb 0x44977d
mov eax, dword [esp + 0x3f8]
push eax
call fcn.0058fc40
add esp, 4
lea ecx, [esp + 0xb4]
mov dword [esp + 0x40c], 0xf
mov dword [esp + 0x408], ebx
mov byte [esp + 0x3f8], bl
call fcn.00435c60
jmp 0x4495c0
mov eax, dword [eax]
jmp 0x4495fd
mov byte [esp + 0xe40], 0xf5
cmp dword [esp + 0x428], esi
jb 0x4497cf
mov ecx, dword [esp + 0x414]
push ecx
call fcn.0058fc40
add esp, 4
mov eax, dword [esp + 0xbc]
lea edx, [esp + 0x42c]
push edx
push eax
mov dword [esp + 0x430], 0xf
mov dword [esp + 0x42c], ebx
mov byte [esp + 0x41c], bl
call fcn.0058eda6
test eax, eax
jne 0x449490
cmp dword [esp + 0x3f0], esi
jb 0x44981e
mov edx, dword [esp + 0x3dc]
push edx
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3f0], 0xf
mov byte [esp + 0x3dc], bl
mov dword [esp + 0x3ec], ebx
lea ecx, [esp + 0x58]
mov dword [esp + 0xe40], 0xffffffff
call fcn.0044c5b0
mov eax, 0x621cb4
mov ecx, dword [esp + 0xe38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe20]
xor ecx, esp
call fcn.0058fcd6
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xbc]
push ecx
call dword [0x5a02e8]
mov eax, dword [esp + 0xb4]
cmp eax, ebx
jne 0x449939
call fcn.0058fce6
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x4498a2
call fcn.0058fce6
push 0xffffffffffffffff
lea eax, [edi + 0x28]
push ebx
push eax
mov ecx, 0x621cb4
call fcn.0040ba20
cmp dword [esp + 0x40c], esi
jb 0x4498cc
mov edx, dword [esp + 0x3f8]
push edx
call fcn.0058fc40
add esp, 4
mov edi, 0xf
mov dword [esp + 0x40c], edi
mov dword [esp + 0x408], ebx
mov byte [esp + 0x3f8], bl
cmp dword [esp + 0x428], esi
jb 0x4498ff
mov eax, dword [esp + 0x414]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x428], edi
mov dword [esp + 0x424], ebx
mov byte [esp + 0x414], bl
cmp dword [esp + 0x3f0], esi
jb 0x44992d
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x3f0], edi
jmp 0x449829
mov eax, dword [eax]
jmp 0x449898