Function at 0x404168
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov dword [ebp - 0xc], 1
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4041a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_open_SCManager__gla_d
call fcn.004027ab
add esp, 8
xor eax, eax
jmp 0x406449
mov eax, dword [ebp + 8]
push eax
push str.Waiting_up_to__d_ms_for_critical_services_to_be_running
call fcn.004027ab
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push 0x409934
call fcn.004027ab
add esp, 4
push str.Checking_internal_system_services
call fcn.004027ab
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4041f5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x404208
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub ecx, eax
or edx, 0xffffffff
sub edx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jb 0x404219
mov dword [ebp - 0x14], 0
jmp 0x40424e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404232
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
jmp 0x404245
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub ecx, eax
or edx, 0xffffffff
sub edx, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
push str.rpcss
mov edx, dword [ebp - 4]
push edx
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404284
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jmp 0x404297
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 8]
jb 0x4042a8
mov dword [ebp - 0x20], 0
jmp 0x4042dd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4042c1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
jmp 0x4042d4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
push str.dcomlaunch
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404313
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
jmp 0x404326
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp + 8]
jb 0x404337
mov dword [ebp - 0x2c], 0
jmp 0x40436c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404350
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
jmp 0x404363
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
push edx
push str.shellhwdetection
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4043a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
jmp 0x4043b5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp + 8]
jb 0x4043c6
mov dword [ebp - 0x38], 0
jmp 0x4043fb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4043df
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
jmp 0x4043f2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
push edx
push str.plugplay
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404431
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x40], eax
jmp 0x404444
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp + 8]
jb 0x404455
mov dword [ebp - 0x44], 0
jmp 0x40448a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40446e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x48], eax
jmp 0x404481
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x48]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
push edx
push str.umwdf
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4044c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x4c], eax
jmp 0x4044d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp + 8]
jb 0x4044e4
mov dword [ebp - 0x50], 0
jmp 0x404519
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4044fd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
jmp 0x404510
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x54]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
push edx
push str.wzcsvc
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40454f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x58], eax
jmp 0x404562
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp + 8]
jb 0x404573
mov dword [ebp - 0x5c], 0
jmp 0x4045a8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40458c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x60], eax
jmp 0x40459f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x60]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x5c]
push edx
push str.hidserv
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
push 0x409938
call fcn.004027ab
add esp, 4
push str.Checking_network_services
call fcn.004027ab
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4045f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x64], eax
jmp 0x40460b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [ebp + 8]
jb 0x40461c
mov dword [ebp - 0x68], 0
jmp 0x404651
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404635
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
jmp 0x404648
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x68]
push edx
push str.dnscache
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404687
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x70], eax
jmp 0x40469a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
cmp ecx, dword [ebp + 8]
jb 0x4046ab
mov dword [ebp - 0x74], 0
jmp 0x4046e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4046c4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x78], eax
jmp 0x4046d7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x78]
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp - 0x74]
push edx
push str.dhcp
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404716
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x7c], eax
jmp 0x404729
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
cmp ecx, dword [ebp + 8]
jb 0x40473a
mov dword [ebp - 0x80], 0
jmp 0x404778
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404756
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x84], eax
jmp 0x40476c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x84]
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x80]
push edx
push str.lanmanserver
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4047b1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x88], eax
jmp 0x4047c7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
cmp ecx, dword [ebp + 8]
jb 0x4047de
mov dword [ebp - 0x8c], 0
jmp 0x40481f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4047fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x90], eax
jmp 0x404810
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x90]
mov dword [ebp - 0x8c], ecx
mov edx, dword [ebp - 0x8c]
push edx
push str.lanmanworkstation
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40485b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x94], eax
jmp 0x404871
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
cmp ecx, dword [ebp + 8]
jb 0x404888
mov dword [ebp - 0x98], 0
jmp 0x4048c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4048a4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x9c], eax
jmp 0x4048ba
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x98]
push edx
push str.netman
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404905
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xa0], eax
jmp 0x40491b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xa0]
cmp ecx, dword [ebp + 8]
jb 0x404932
mov dword [ebp - 0xa4], 0
jmp 0x404973
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40494e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xa8], eax
jmp 0x404964
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0xa8]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0xa4]
push edx
push str.browser
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4049af
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xac], eax
jmp 0x4049c5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
cmp ecx, dword [ebp + 8]
jb 0x4049dc
mov dword [ebp - 0xb0], 0
jmp 0x404a1d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4049f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xb4], eax
jmp 0x404a0e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0xb4]
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0xb0]
push edx
push str.sharedaccess
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
push 0x40993c
call fcn.004027ab
add esp, 4
push str.Checking_feature_services
call fcn.004027ab
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404a73
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xb8], eax
jmp 0x404a89
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
cmp ecx, dword [ebp + 8]
jb 0x404aa0
mov dword [ebp - 0xbc], 0
jmp 0x404ae1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404abc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc0], eax
jmp 0x404ad2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0xc0]
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp - 0xbc]
push edx
push str.eventlog
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404b1d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc4], eax
jmp 0x404b33
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
cmp ecx, dword [ebp + 8]
jb 0x404b4a
mov dword [ebp - 0xc8], 0
jmp 0x404b8b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404b66
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xcc], eax
jmp 0x404b7c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xc8], ecx
mov edx, dword [ebp - 0xc8]
push edx
push str.audiosrv
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404bc7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xd0], eax
jmp 0x404bdd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0xd0]
cmp ecx, dword [ebp + 8]
jb 0x404bf4
mov dword [ebp - 0xd4], 0
jmp 0x404c35
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404c10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xd8], eax
jmp 0x404c26
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0xd8]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0xd4]
push edx
push str.spooler
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404c71
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xdc], eax
jmp 0x404c87
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0xdc]
cmp ecx, dword [ebp + 8]
jb 0x404c9e
mov dword [ebp - 0xe0], 0
jmp 0x404cdf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404cba
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xe4], eax
jmp 0x404cd0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0xe4]
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0xe0]
push edx
push 0x4092dc
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404d1b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xe8], eax
jmp 0x404d31
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [ebp + 8]
jb 0x404d48
mov dword [ebp - 0xec], 0
jmp 0x404d89
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404d64
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xf0], eax
jmp 0x404d7a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xf0], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0xf0]
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0xec]
push edx
push str.winmgmt
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404dc5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xf4], eax
jmp 0x404ddb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0xf4]
cmp ecx, dword [ebp + 8]
jb 0x404df2
mov dword [ebp - 0xf8], 0
jmp 0x404e33
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404e0e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xfc], eax
jmp 0x404e24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0xfc]
mov dword [ebp - 0xf8], ecx
mov edx, dword [ebp - 0xf8]
push edx
push str.w32time
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
push 0x409940
call fcn.004027ab
add esp, 4
push str.Checking_antivirus_antithreat_tool
call fcn.004027ab
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404e89
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x100], eax
jmp 0x404e9f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x100]
cmp ecx, dword [ebp + 8]
jb 0x404eb6
mov dword [ebp - 0x104], 0
jmp 0x404ef7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404ed2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x108], eax
jmp 0x404ee8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x108]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
push str.symantec_antivirus
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404f33
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x10c], eax
jmp 0x404f49
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp + 8]
jb 0x404f60
mov dword [ebp - 0x110], 0
jmp 0x404fa1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404f7c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x114], eax
jmp 0x404f92
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x114]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x110]
push edx
push str.tmlisten
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x404fdd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x118], eax
jmp 0x404ff3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp + 8]
jb 0x40500a
mov dword [ebp - 0x11c], 0
jmp 0x40504b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405026
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x120], eax
jmp 0x40503c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x120]
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0x11c]
push edx
push str.tmbmserver
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405087
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x124], eax
jmp 0x40509d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp + 8]
jb 0x4050b4
mov dword [ebp - 0x128], 0
jmp 0x4050f5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4050d0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x12c], eax
jmp 0x4050e6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x128]
push edx
push str.ntrtscan
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405131
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x130], eax
jmp 0x405147
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [ebp + 8]
jb 0x40515e
mov dword [ebp - 0x134], 0
jmp 0x40519f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40517a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x138], eax
jmp 0x405190
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x138]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
push edx
push str.tmpfw
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4051db
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x13c], eax
jmp 0x4051f1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
cmp ecx, dword [ebp + 8]
jb 0x405208
mov dword [ebp - 0x140], 0
jmp 0x405249
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405224
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x144], eax
jmp 0x40523a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x144]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x140]
push edx
push str.tmproxy
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405285
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x148], eax
jmp 0x40529b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x148]
cmp ecx, dword [ebp + 8]
jb 0x4052b2
mov dword [ebp - 0x14c], 0
jmp 0x4052f3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4052ce
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x150], eax
jmp 0x4052e4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x150]
mov dword [ebp - 0x14c], ecx
mov edx, dword [ebp - 0x14c]
push edx
push str.mcshield
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40532f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x154], eax
jmp 0x405345
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x154]
cmp ecx, dword [ebp + 8]
jb 0x40535c
mov dword [ebp - 0x158], 0
jmp 0x40539d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405378
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x15c], eax
jmp 0x40538e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x158]
push edx
push str.windefend
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4053d9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x160], eax
jmp 0x4053ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
cmp ecx, dword [ebp + 8]
jb 0x405406
mov dword [ebp - 0x164], 0
jmp 0x405447
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405422
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x168], eax
jmp 0x405438
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x168], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x168]
mov dword [ebp - 0x164], ecx
mov edx, dword [ebp - 0x164]
push edx
push str.msmpsvc
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405483
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x16c], eax
jmp 0x405499
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x16c]
cmp ecx, dword [ebp + 8]
jb 0x4054b0
mov dword [ebp - 0x170], 0
jmp 0x4054f1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4054cc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x174], eax
jmp 0x4054e2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x174]
mov dword [ebp - 0x170], ecx
mov edx, dword [ebp - 0x170]
push edx
push str.msmpeng
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40552d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x178], eax
jmp 0x405543
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
cmp ecx, dword [ebp + 8]
jb 0x40555a
mov dword [ebp - 0x17c], 0
jmp 0x40559b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405576
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
jmp 0x40558c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x180], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x180]
mov dword [ebp - 0x17c], ecx
mov edx, dword [ebp - 0x17c]
push edx
push str.savservice
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4055d7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x184], eax
jmp 0x4055ed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x184]
cmp ecx, dword [ebp + 8]
jb 0x405604
mov dword [ebp - 0x188], 0
jmp 0x405645
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405620
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x18c], eax
jmp 0x405636
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x18c]
mov dword [ebp - 0x188], ecx
mov edx, dword [ebp - 0x188]
push edx
push str.aveservice
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405681
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x190], eax
jmp 0x405697
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x190], eax
mov ecx, dword [ebp - 0x190]
cmp ecx, dword [ebp + 8]
jb 0x4056ae
mov dword [ebp - 0x194], 0
jmp 0x4056ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4056ca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x198], eax
jmp 0x4056e0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x198], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x198]
mov dword [ebp - 0x194], ecx
mov edx, dword [ebp - 0x194]
push edx
push str.avast__antivirus
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40572b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x19c], eax
jmp 0x405741
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
cmp ecx, dword [ebp + 8]
jb 0x405758
mov dword [ebp - 0x1a0], 0
jmp 0x405799
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405774
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1a4], eax
jmp 0x40578a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a0], ecx
mov edx, dword [ebp - 0x1a0]
push edx
push str.immunetprotect
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4057d5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1a8], eax
jmp 0x4057eb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x1a8]
cmp ecx, dword [ebp + 8]
jb 0x405802
mov dword [ebp - 0x1ac], 0
jmp 0x405843
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40581e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1b0], eax
jmp 0x405834
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1ac], ecx
mov edx, dword [ebp - 0x1ac]
push edx
push str.fsma
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x40587f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1b4], eax
jmp 0x405895
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1b4], eax
mov ecx, dword [ebp - 0x1b4]
cmp ecx, dword [ebp + 8]
jb 0x4058ac
mov dword [ebp - 0x1b8], 0
jmp 0x4058ed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4058c8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1bc], eax
jmp 0x4058de
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1b8], ecx
mov edx, dword [ebp - 0x1b8]
push edx
push str.antivirservice
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405929
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1c0], eax
jmp 0x40593f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1c0], eax
mov ecx, dword [ebp - 0x1c0]
cmp ecx, dword [ebp + 8]
jb 0x405956
mov dword [ebp - 0x1c4], 0
jmp 0x405997
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405972
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1c8], eax
jmp 0x405988
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1c8], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x1c4], ecx
mov edx, dword [ebp - 0x1c4]
push edx
push str.avguard
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x4059d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1cc], eax
jmp 0x4059e9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1cc], eax
mov ecx, dword [ebp - 0x1cc]
cmp ecx, dword [ebp + 8]
jb 0x405a00
mov dword [ebp - 0x1d0], 0
jmp 0x405a41
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405a1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1d4], eax
jmp 0x405a32
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1d4], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x1d4]
mov dword [ebp - 0x1d0], ecx
mov edx, dword [ebp - 0x1d0]
push edx
push str.fpavserver
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405a7d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1d8], eax
jmp 0x405a93
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1d8], eax
mov ecx, dword [ebp - 0x1d8]
cmp ecx, dword [ebp + 8]
jb 0x405aaa
mov dword [ebp - 0x1dc], 0
jmp 0x405aeb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405ac6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1e0], eax
jmp 0x405adc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1e0], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x1e0]
mov dword [ebp - 0x1dc], ecx
mov edx, dword [ebp - 0x1dc]
push edx
push str.pshost
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405b27
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1e4], eax
jmp 0x405b3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0x1e4]
cmp ecx, dword [ebp + 8]
jb 0x405b54
mov dword [ebp - 0x1e8], 0
jmp 0x405b95
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405b70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1ec], eax
jmp 0x405b86
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1ec], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x1ec]
mov dword [ebp - 0x1e8], ecx
mov edx, dword [ebp - 0x1e8]
push edx
push str.pavsrv
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405bd1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1f0], eax
jmp 0x405be7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1f0], eax
mov ecx, dword [ebp - 0x1f0]
cmp ecx, dword [ebp + 8]
jb 0x405bfe
mov dword [ebp - 0x1f4], 0
jmp 0x405c3f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405c1a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1f8], eax
jmp 0x405c30
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x1f8]
mov dword [ebp - 0x1f4], ecx
mov edx, dword [ebp - 0x1f4]
push edx
push str.bdss
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405c7b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1fc], eax
jmp 0x405c91
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x1fc], eax
mov ecx, dword [ebp - 0x1fc]
cmp ecx, dword [ebp + 8]
jb 0x405ca8
mov dword [ebp - 0x200], 0
jmp 0x405ce9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405cc4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x204], eax
jmp 0x405cda
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x204]
mov dword [ebp - 0x200], ecx
mov edx, dword [ebp - 0x200]
push edx
push str.abmainsv
mov eax, dword [ebp - 4]
push eax
call fcn.00403c84
add esp, 0xc
mov ecx, dword [ebp - 0xc]
and ecx, eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 8]
jb 0x405d25
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x208], eax
jmp 0x405d3b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x208]
cmp ecx, dword [ebp + 8]
jb 0x405d52
mov esp, ebp
pop ebp
ret