Function at 0x5b3388
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Parse pe header

Disassembly:
push 0xecc
mov eax, 0x6544ee
call fcn.00626aed
mov eax, dword fs:[0x2c]
mov ecx, dword [0x710994]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x710504]
cmp eax, dword [ecx + 4]
jg 0x5b4d1a
cmp byte [0x70a26c], 0
je 0x5b4d0f
lea eax, [ebp - 0xecc]
xor ebx, ebx
push eax
mov dword [ebp - 0xecc], ebx
mov dword [ebp - 0xec8], ebx
call fcn.005b1dd0
mov dword [ebp - 0xecc], eax
lea ecx, [ebp - 0x810]
mov dword [ebp - 4], ebx
mov dword [esp], str.avp.exe
call fcn.00448670
mov esi, str.Kaspersky
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.avpui.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 3
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.nav.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov esi, str.Norton
mov byte [ebp - 4], 5
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.ns.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7f8]
push esi
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.nortonsecurity.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 9
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.nswscsvc.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0xb
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.ekrn.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov esi, 0x663788
mov byte [ebp - 4], 0xd
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.egui.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0xf
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.eguiproxy.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x11
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.avastsvc.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push str.Avast
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x13
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.mcshield.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push str.McAfee
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x15
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.cavwp.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov esi, str.Comodo
mov byte [ebp - 4], 0x17
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.dragon_updater.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x19
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.cis.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x1b
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.cmdagent.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x1d
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x7f8]
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.psuamain.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov esi, str.Panda
mov byte [ebp - 4], 0x1f
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.PSUAConsole.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x21
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.avguard.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push str.Avira
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x23
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.dwengine.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov esi, str.DrWeb
mov byte [ebp - 4], 0x25
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x27
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.dwantispam.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x29
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.dwservice.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2b
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.dwnetfilter.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2d
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.dwwatcher.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2f
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x30
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.avgidsagent.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov esi, 0x6638c8
mov byte [ebp - 4], 0x31
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x32
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.avgToolsSvc.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x33
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x34
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.AVGUI.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov byte [ebp - 4], 0x35
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x36
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.aswEngSrv.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x37
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x38
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.wsc_proxy.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x39
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.AVGSvc.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x3b
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.coreserviceshell.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov esi, str.TrendMicro
mov byte [ebp - 4], 0x3d
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.uiWatchDog.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x3f
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x40
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.Tmsalnstance64.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x41
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x42
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.AMSPTelemetryService.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x43
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x44
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.coreFrameworkHost.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x45
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x46
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.bdagent.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
mov esi, str.BitDefender
mov byte [ebp - 4], 0x47
push esi
lea ecx, [ebp - 0x7f8]
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x48
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.gziface.exe
lea ecx, [ebp - 0x810]
call fcn.00448670
push esi
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x49
call fcn.00448670
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x810]
call fcn.00448620
push str.ProductAgentService.exe
lea ecx, [ebp - 0x870]
call fcn.00448670
push esi
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0x4b
call fcn.00448670
lea eax, [ebp - 0x870]
mov byte [ebp - 4], 0x4c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x870]
call fcn.00448620
push str.vsservppl.exe
lea ecx, [ebp - 0x840]
call fcn.00448670
push esi
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x4d
call fcn.00448670
lea eax, [ebp - 0x840]
mov byte [ebp - 4], 0x4e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x840]
call fcn.00448620
push str.bdredline.exe
lea ecx, [ebp - 0x930]
call fcn.00448670
push esi
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 0x4f
call fcn.00448670
lea eax, [ebp - 0x930]
mov byte [ebp - 4], 0x50
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x930]
call fcn.00448620
push str.vsserv.exe
lea ecx, [ebp - 0x960]
call fcn.00448670
push esi
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], 0x51
call fcn.00448670
lea eax, [ebp - 0x960]
mov byte [ebp - 4], 0x52
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x960]
call fcn.00448620
push str.updatesrv.exe
lea ecx, [ebp - 0x990]
call fcn.00448670
push esi
lea ecx, [ebp - 0x978]
mov byte [ebp - 4], 0x53
call fcn.00448670
lea eax, [ebp - 0x990]
mov byte [ebp - 4], 0x54
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x978]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x990]
call fcn.00448620
push str.mbamservice.exe
lea ecx, [ebp - 0x9c0]
call fcn.00448670
push str.MalwareBytes
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], 0x55
call fcn.00448670
lea eax, [ebp - 0x9c0]
mov byte [ebp - 4], 0x56
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x9c0]
call fcn.00448620
push str.freshclam.exe
lea ecx, [ebp - 0x9f0]
call fcn.00448670
mov esi, str.Clamav
mov byte [ebp - 4], 0x57
push esi
lea ecx, [ebp - 0x9d8]
call fcn.00448670
lea eax, [ebp - 0x9f0]
mov byte [ebp - 4], 0x58
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x9d8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x9f0]
call fcn.00448620
push str.freshclamwrap.exe
lea ecx, [ebp - 0xa20]
call fcn.00448670
push esi
lea ecx, [ebp - 0xa08]
mov byte [ebp - 4], 0x59
call fcn.00448670
lea eax, [ebp - 0xa20]
mov byte [ebp - 4], 0x5a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xa08]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xa20]
call fcn.00448620
push str.gdscan.exe
lea ecx, [ebp - 0xa50]
call fcn.00448670
push str.GData
lea ecx, [ebp - 0xa38]
mov byte [ebp - 4], 0x5b
call fcn.00448670
lea eax, [ebp - 0xa50]
mov byte [ebp - 4], 0x5c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xa38]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xa50]
call fcn.00448620
push str.a2start.exe
lea ecx, [ebp - 0xa80]
call fcn.00448670
push str.Emsisoft
lea ecx, [ebp - 0xa68]
mov byte [ebp - 4], 0x5d
call fcn.00448670
lea eax, [ebp - 0xa80]
mov byte [ebp - 4], 0x5e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xa68]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xa80]
call fcn.00448620
push str.k7tsecurity.exe
lea ecx, [ebp - 0xab0]
call fcn.00448670
mov esi, 0x663a84
mov byte [ebp - 4], 0x5f
push esi
lea ecx, [ebp - 0xa98]
call fcn.00448670
lea eax, [ebp - 0xab0]
mov byte [ebp - 4], 0x60
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xa98]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xab0]
call fcn.00448620
push str.k7tsmain.exe
lea ecx, [ebp - 0xae0]
call fcn.00448670
push esi
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0x61
call fcn.00448670
lea eax, [ebp - 0xae0]
mov byte [ebp - 4], 0x62
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xae0]
call fcn.00448620
push str.tpeasy.exe
lea ecx, [ebp - 0xb10]
call fcn.00448670
push str.TrustPort
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], 0x63
call fcn.00448670
lea eax, [ebp - 0xb10]
mov byte [ebp - 4], 0x64
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xb10]
call fcn.00448620
push str.vipreui.exe
lea ecx, [ebp - 0xb40]
call fcn.00448670
push str.Vipre
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], 0x65
call fcn.00448670
lea eax, [ebp - 0xb40]
mov byte [ebp - 4], 0x66
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xb40]
call fcn.00448620
push str.qhactivedefense.exe
lea ecx, [ebp - 0xb70]
call fcn.00448670
mov esi, str.Q360
mov byte [ebp - 4], 0x67
push esi
lea ecx, [ebp - 0xb58]
call fcn.00448670
lea eax, [ebp - 0xb70]
mov byte [ebp - 4], 0x68
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xb58]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xb70]
call fcn.00448620
push str.qhsafetray.exe
lea ecx, [ebp - 0xba0]
call fcn.00448670
push esi
lea ecx, [ebp - 0xb88]
mov byte [ebp - 4], 0x69
call fcn.00448670
lea eax, [ebp - 0xba0]
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xb88]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xba0]
call fcn.00448620
push str.qhwatchdog.exe
lea ecx, [ebp - 0xbd0]
call fcn.00448670
push esi
lea ecx, [ebp - 0xbb8]
mov byte [ebp - 4], 0x6b
call fcn.00448670
lea eax, [ebp - 0xbd0]
mov byte [ebp - 4], 0x6c
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xbb8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xbd0]
call fcn.00448620
push str.liveupdate360.exe
lea ecx, [ebp - 0xc00]
call fcn.00448670
push esi
lea ecx, [ebp - 0xbe8]
mov byte [ebp - 4], 0x6d
call fcn.00448670
lea eax, [ebp - 0xc00]
mov byte [ebp - 4], 0x6e
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xbe8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xc00]
call fcn.00448620
push str.360tsliveupd.exe
lea ecx, [ebp - 0xc30]
call fcn.00448670
push esi
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], 0x6f
call fcn.00448670
lea eax, [ebp - 0xc30]
mov byte [ebp - 4], 0x70
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xc30]
call fcn.00448620
push str.adblockerultimategui.exe
lea ecx, [ebp - 0xc60]
call fcn.00448670
push str.AdBlocker
lea ecx, [ebp - 0xc48]
mov byte [ebp - 4], 0x71
call fcn.00448670
lea eax, [ebp - 0xc60]
mov byte [ebp - 4], 0x72
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xc48]
call fcn.00448620
lea ecx, [ebp - 0xc60]
call fcn.00448620
push str.adlock.exe
lea ecx, [ebp - 0xc90]
call fcn.00448670
push str.AdLock
lea ecx, [ebp - 0xc78]
mov byte [ebp - 4], 0x73
call fcn.00448670
lea eax, [ebp - 0xc90]
mov byte [ebp - 4], 0x74
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0xc78]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0xc90]
call fcn.00448620
push str.ghostery_midnight.exe
lea ecx, [ebp - 0x8a0]
call fcn.00448670
push str.Ghostery
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0x75
call fcn.00448670
lea eax, [ebp - 0x8a0]
mov byte [ebp - 4], 0x76
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x8a0]
call fcn.00448620
push str.msmpeng.exe
lea ecx, [ebp - 0x8d0]
call fcn.00448670
mov esi, str.Microsoft
mov byte [ebp - 4], 0x77
push esi
lea ecx, [ebp - 0x8b8]
call fcn.00448670
lea eax, [ebp - 0x8d0]
mov byte [ebp - 4], 0x78
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x8b8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x8d0]
call fcn.00448620
push str.msseces.exe
lea ecx, [ebp - 0x900]
call fcn.00448670
push esi
lea ecx, [ebp - 0x8e8]
mov byte [ebp - 4], 0x79
call fcn.00448670
lea eax, [ebp - 0x900]
mov byte [ebp - 4], 0x7a
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xecc]
call fcn.005b1e79
lea ecx, [ebp - 0x8e8]
mov byte [ebp - 4], bl
call fcn.00448620
lea ecx, [ebp - 0x900]
call fcn.00448620
push ebx
push 2
mov dword [ebp - 0xebc], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0xed8], ebx
test ebx, ebx
je 0x5b4d03
lea eax, [ebp - 0xebc]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5b4d03
push 0x3e8
lea eax, [ebp - 0xe98]
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.00631e27
add esp, 0xc
lea eax, [ebp - 0x7e0]
lea ecx, [ebp - 0x7f8]
push eax
call fcn.00448670
cmp dword [ebp - 0x7e4], 0x10
lea ecx, [ebp - 0x7f8]
mov eax, dword [ebp - 0x7e8]
lea edi, [ebp - 0x7f8]
cmovae ecx, dword [ebp - 0x7f8]
lea esi, [ebp - 0x7f8]
cmovae edi, dword [ebp - 0x7f8]
add eax, ecx
cmp dword [ebp - 0x7e4], 0x10
mov byte [ebp - 4], 0x7b
cmovae esi, dword [ebp - 0x7f8]
cmp esi, eax
je 0x5b4999
sub edi, esi
mov ebx, eax
movsx eax, byte [esi]
push eax
call fcn.00631f45
mov byte [edi + esi], al
inc esi
pop ecx
cmp esi, ebx
jne 0x5b4981
mov ebx, dword [ebp - 0xed8]
mov eax, dword [ebp - 0xecc]
mov esi, dword [eax]
mov dword [ebp - 0xed0], esi
mov dword [ebp - 0xec0], esi
cmp esi, eax
je 0x5b4cb6
xor ecx, ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
lea ecx, [ebp - 0x828]
push eax
call fcn.005a2638
cmp dword [ebp - 0x814], 0x10
lea ecx, [ebp - 0x828]
mov eax, dword [ebp - 0x818]
lea ebx, [ebp - 0x828]
cmovae ecx, dword [ebp - 0x828]
lea edi, [ebp - 0x828]
cmovae ebx, dword [ebp - 0x828]
add eax, ecx
cmp dword [ebp - 0x814], 0x10
mov byte [ebp - 4], 0x7c
cmovae edi, dword [ebp - 0x828]
cmp edi, eax
je 0x5b4a39
sub ebx, edi
mov esi, eax
movsx eax, byte [edi]
push eax
call fcn.00631f45
mov byte [ebx + edi], al
inc edi
pop ecx
cmp edi, esi
jne 0x5b4a21
mov esi, dword [ebp - 0xed0]
lea eax, [ebp - 0x7f8]
push eax
lea ecx, [ebp - 0x828]
call fcn.005a6cd6
test al, al
jne 0x5b4ad4
mov eax, dword [ebp - 0x814]
mov byte [ebp - 4], 0x7b
cmp eax, 0x10
jb 0x5b4aa6
mov ecx, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0xed4], eax
mov dword [ebp - 0xed0], ecx
cmp eax, 0x1000
jb 0x5b4a9d
lea eax, [ebp - 0xed4]
push eax
lea eax, [ebp - 0xed0]
push eax
call fcn.00446e30
mov eax, dword [ebp - 0xed4]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xed0]
push eax
push ecx
call fcn.00626a67
pop ecx
pop ecx
lea ecx, [ebp - 0xec0]
call fcn.005b26c2
mov esi, dword [ebp - 0xec0]
mov dword [ebp - 0xed0], esi
cmp esi, dword [ebp - 0xecc]
jne 0x5b49b5
mov ebx, dword [ebp - 0xed8]
jmp 0x5b4cb6
push dword [ebp - 0xed8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x28
mov ecx, 0x70a270
push esi
call fcn.004485f0
mov eax, dword [ebp - 0x814]
cmp eax, 0x10
jb 0x5b4cf8
mov ecx, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0xec0], eax
mov dword [ebp - 0xed0], ecx
cmp eax, 0x1000
jb 0x5b4b38
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0xed0]
push eax
call fcn.00446e30
mov eax, dword [ebp - 0xec0]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xed0]
push eax
push ecx
call fcn.00626a67
pop ecx
pop ecx
jmp 0x5b4cf8
push 0x3e8
lea eax, [ebp - 0xe98]
push eax
lea eax, [ebp - 0x3f8]
push eax
call fcn.00631e27
add esp, 0xc
lea eax, [ebp - 0x3f8]
lea ecx, [ebp - 0x858]
push eax
call fcn.00448670
cmp dword [ebp - 0x844], 0x10
lea ecx, [ebp - 0x858]
mov eax, dword [ebp - 0x848]
lea edi, [ebp - 0x858]
cmovae ecx, dword [ebp - 0x858]
lea esi, [ebp - 0x858]
cmovae edi, dword [ebp - 0x858]
add eax, ecx
cmp dword [ebp - 0x844], 0x10
mov byte [ebp - 4], 0x7d
cmovae esi, dword [ebp - 0x858]
cmp esi, eax
je 0x5b4bd4
sub edi, esi
mov ebx, eax
movsx eax, byte [esi]
push eax
call fcn.00631f45
mov byte [esi + edi], al
inc esi
pop ecx
cmp esi, ebx
jne 0x5b4bbc
mov ebx, dword [ebp - 0xed8]
mov eax, dword [ebp - 0xecc]
mov esi, dword [eax]
mov dword [ebp - 0xec0], esi
cmp esi, eax
je 0x5b4ca7
xor ecx, ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
lea ecx, [ebp - 0x828]
push eax
call fcn.005a2638
cmp dword [ebp - 0x814], 0x10
lea ecx, [ebp - 0x828]
mov eax, dword [ebp - 0x818]
lea edx, [ebp - 0x828]
cmovae ecx, dword [ebp - 0x828]
cmovae edx, dword [ebp - 0x828]
add eax, ecx
cmp dword [ebp - 0x814], 0x10
lea ecx, [ebp - 0x828]
push fcn.00631f45
cmovae ecx, dword [ebp - 0x828]
push edx
push eax
push ecx
lea eax, [ebp - 0xed0]
mov byte [ebp - 4], 0x7e
push eax
call fcn.005b2343
add esp, 0x14
lea eax, [ebp - 0x858]
lea ecx, [ebp - 0x828]
push eax
call fcn.005a6cd6
test al, al
jne 0x5b4ccd
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x7d
call fcn.00448620
lea ecx, [ebp - 0xec0]
call fcn.005b26c2
mov esi, dword [ebp - 0xec0]
cmp esi, dword [ebp - 0xecc]
jne 0x5b4bea
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0x7b
call fcn.00448620
lea eax, [ebp - 0xebc]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5b4b46
jmp 0x5b4cf8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x28
mov ecx, 0x70a270
push esi
call fcn.004485f0
lea ecx, [ebp - 0x828]
call fcn.00448620
lea ecx, [ebp - 0x858]
call fcn.00448620
lea ecx, [ebp - 0x7f8]
call fcn.00448620
lea ecx, [ebp - 0xecc]
push ecx
call fcn.005b1ff5
mov eax, 0x70a270
call fcn.00626a9c
ret
mov esi, 0x710504
push esi
call fcn.00626d2a
cmp dword [0x710504], 0xffffffff
pop ecx
jne 0x5b33b7
push 0x659310
call fcn.00627162
push esi
call fcn.00626ce0
pop ecx
pop ecx
jmp 0x5b33b7