Function at 0x5cf340
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x692e30
mov eax, dword fs:[0]
push eax
sub esp, 0xee4
mov eax, dword [0x74e694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x754b3c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x7546b0]
cmp eax, dword [ecx + 4]
jg 0x5d0e9e
cmp byte [0x74e3a0], 0
je 0x5d0e7d
push 0x40
mov dword [ebp - 0xec4], 0
mov dword [ebp - 0xec0], 0
call fcn.00663a97
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0xec4], eax
mov eax, dword [str.avp.exe]
mov dword [ebp - 0x810], eax
mov ax, word [0x6a4b18]
mov word [ebp - 0x80c], ax
mov al, byte [0x6a4b1a]
mov dword [ebp - 4], 0
mov dword [ebp - 0x7fc], 0xf
mov dword [ebp - 0x800], 7
mov byte [ebp - 0x80a], al
mov byte [ebp - 0x809], 0
movq xmm0, qword [str.Kaspersky]
mov al, byte [0x6a4b10]
mov dword [ebp - 0x7e4], 0xf
mov dword [ebp - 0x7e8], 9
movq qword [ebp - 0x7f8], xmm0
mov byte [ebp - 0x7f0], al
mov byte [ebp - 0x7ef], 0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
mov edx, dword [ebp - 0x7e4]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x5cf4a3
mov ecx, dword [ebp - 0x7f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5cf499
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d0ed4
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov edx, dword [ebp - 0x7fc]
cmp edx, 0x10
jb 0x5cf4dd
mov ecx, dword [ebp - 0x810]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5cf4d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d0ed4
push edx
push ecx
call fcn.00663ac7
add esp, 8
movq xmm0, qword [str.avpui.exe]
mov al, byte [0x6a4b24]
mov dword [ebp - 0x7fc], 0xf
mov dword [ebp - 0x800], 9
movq qword [ebp - 0x810], xmm0
mov byte [ebp - 0x808], al
mov byte [ebp - 0x807], 0
movq xmm0, qword [str.Kaspersky]
mov al, byte [0x6a4b10]
mov dword [ebp - 0x7e4], 0xf
mov dword [ebp - 0x7e8], 9
movq qword [ebp - 0x7f8], xmm0
mov byte [ebp - 0x7f0], al
mov byte [ebp - 0x7ef], 0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
mov edx, dword [ebp - 0x7e4]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x5cf5a4
mov ecx, dword [ebp - 0x7f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5cf59a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d0ed4
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov edx, dword [ebp - 0x7fc]
cmp edx, 0x10
jb 0x5cf5de
mov ecx, dword [ebp - 0x810]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5cf5d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d0ed4
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov eax, dword [str.nav.exe]
mov dword [ebp - 0x810], eax
movzx eax, word [0x6a4b34]
mov word [ebp - 0x80c], ax
mov al, byte [0x6a4b36]
mov dword [ebp - 0x7fc], 0xf
mov dword [ebp - 0x800], 7
mov byte [ebp - 0x80a], al
mov byte [ebp - 0x809], 0
mov eax, dword [str.Norton]
mov dword [ebp - 0x7f8], eax
movzx eax, word [0x6a4b2c]
mov dword [ebp - 0x7e4], 0xf
mov dword [ebp - 0x7e8], 6
mov word [ebp - 0x7f4], ax
mov byte [ebp - 0x7f2], 0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
mov edx, dword [ebp - 0x7e4]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x5cf6ac
mov ecx, dword [ebp - 0x7f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5cf6a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d0ed4
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov edx, dword [ebp - 0x7fc]
cmp edx, 0x10
jb 0x5cf6e6
mov ecx, dword [ebp - 0x810]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5cf6dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d0ed4
push edx
push ecx
call fcn.00663ac7
add esp, 8
push 6
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.ns.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 6
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.Norton
mov byte [ebp - 4], 7
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Norton
push str.nortonsecurity.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Norton
push str.nswscsvc.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Norton
push str.navapsvc.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4b74
push str.ekrn.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4b74
push str.egui.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4b74
push str.eguiproxy.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Avast
push str.avastsvc.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Avast
push str.ashServ.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.McAfee
push str.mcshield.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.McAfee
push str.MCODS.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Comodo
push str.cavwp.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Comodo
push str.dragon_updater.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Comodo
push str.cis.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Comodo
push str.cmdagent.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Panda
push str.psuamain.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Panda
push str.PSUAConsole.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Panda
push str.AVENGINE.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Avira
push str.avguard.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.DrWeb
push str.dwengine.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.DrWeb
push str.dwarkdaemon.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0xe
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.dwantispam.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
mov dword [ebp - 0x7f8], 0
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
push 5
push str.DrWeb
lea ecx, [ebp - 0x7f8]
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.DrWeb
push str.dwservice.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.DrWeb
push str.dwnetfilter.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.DrWeb
push str.dwwatcher.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4cdc
push str.avgidsagent.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4cdc
push str.avgToolsSvc.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 9
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.AVGUI.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 3
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push 0x6a4cdc
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x25
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4cdc
push str.aswEngSrv.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4cdc
push str.wsc_proxy.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4cdc
push str.AVGSvc.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4cdc
push str.avgemc.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
mov byte [ebp - 4], 0x29
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x14
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.coreserviceshell.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 0xa
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.TrendMicro
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2b
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0xe
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.uiWatchDog.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 0xa
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.TrendMicro
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x12
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.Tmsalnstance64.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 0xa
mov dword [ebp - 0x7f8], 0
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
push str.TrendMicro
lea ecx, [ebp - 0x7f8]
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x18
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.AMSPTelemetryService.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 0xa
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.TrendMicro
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x31
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x15
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.coreFrameworkHost.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 0xa
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.TrendMicro
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x33
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0xc
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.ntrtscan.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
mov byte [ebp - 4], 0x34
push 0xa
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.TrendMicro
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x35
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.TrendMicro
push str.tmntsrv.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x36
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.BitDefender
push str.bdagent.exe
lea ecx, [ebp - 0x810]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x37
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.BitDefender
push str.gziface.exe
lea ecx, [ebp - 0x870]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x38
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x17
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.ProductAgentService.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 0xb
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.BitDefender
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.BitDefender
push str.vsservppl.exe
lea ecx, [ebp - 0x840]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x3b
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x840]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.BitDefender
push str.bdredline.exe
lea ecx, [ebp - 0xa50]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x3c
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0xa50]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0xa
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x810]
push str.vsserv.exe
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
push 0xb
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.BitDefender
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.004484a0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.BitDefender
push str.updatesrv.exe
lea ecx, [ebp - 0xa80]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x3f
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d1a60
lea ecx, [ebp - 0xa80]
mov byte [ebp - 4], 0
call fcn.005d22c0
mov dword [ebp - 0x810], 0
push 0xf
push str.mbamservice.exe
lea ecx, [ebp - 0x810]
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x7fc], 0xf
mov byte [ebp - 0x810], 0
call fcn.004484a0
mov dword [ebp - 0x7f8], 0
lea ecx, [ebp - 0x7f8]
push str.MalwareBytes
mov byte [ebp - 4], 0x40
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0xf
mov byte [ebp - 0x7f8], 0
call fcn.00448bd0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0x41
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Clamav
push str.freshclam.exe
lea ecx, [ebp - 0xab0]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x42
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xab0]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Clamav
push str.freshclamwrap.exe
lea ecx, [ebp - 0xae0]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x43
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xae0]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.GData
push str.gdscan.exe
lea ecx, [ebp - 0xb10]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x44
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xb10]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Emsisoft
push str.a2start.exe
lea ecx, [ebp - 0xb40]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x45
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb40]
call fcn.005d22c0
push 0x6a4ec0
push str.k7tsecurity.exe
lea ecx, [ebp - 0xb70]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x46
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xb70]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0x6a4ec0
push str.k7tsmain.exe
lea ecx, [ebp - 0xba0]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x47
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xba0]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.TrustPort
push str.tpeasy.exe
lea ecx, [ebp - 0xbd0]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x48
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xbd0]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Vipre
push str.vipreui.exe
lea ecx, [ebp - 0xc00]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x49
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xc00]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.MicroWorld
push str.avkwctl.exe
lea ecx, [ebp - 0xc30]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x4a
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xc30]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.FSecure
push str.fsav32.exe
lea ecx, [ebp - 0xc60]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x4b
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xc60]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Q360
push str.qhactivedefense.exe
lea ecx, [ebp - 0xc90]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x4c
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xc90]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Q360
push str.qhsafetray.exe
lea ecx, [ebp - 0x8a0]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x4d
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x8a0]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Q360
push str.qhwatchdog.exe
lea ecx, [ebp - 0x8d0]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x4e
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x8d0]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Q360
push str.liveupdate360.exe
lea ecx, [ebp - 0x900]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x900]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Q360
push str.360tsliveupd.exe
lea ecx, [ebp - 0x930]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x50
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x930]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.AdBlocker
push str.adblockerultimategui.exe
lea ecx, [ebp - 0x960]
call fcn.005d18f0
mov byte [ebp - 4], 0x51
push eax
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.AdLock
push str.adlock.exe
lea ecx, [ebp - 0x990]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x52
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x990]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Ghostery
push str.ghostery_midnight.exe
lea ecx, [ebp - 0x9c0]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x53
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x9c0]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Microsoft
push str.msmpeng.exe
lea ecx, [ebp - 0x9f0]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x54
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 4], 0
call fcn.005d22c0
push str.Microsoft
push str.msseces.exe
lea ecx, [ebp - 0xa20]
call fcn.005d18f0
push eax
lea eax, [ebp - 0xecc]
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0xec4]
call fcn.005d20a0
lea ecx, [ebp - 0xa20]
mov byte [ebp - 4], 0
call fcn.005d22c0
push 0
push 2
mov dword [ebp - 0xebc], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xed4], eax
test eax, eax
je 0x5d0e72
lea ecx, [ebp - 0xebc]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5d0e72
push 0x3e8
lea eax, [ebp - 0xe98]
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.0066ece0
add esp, 0xc
lea eax, [ebp - 0x7e0]
lea ecx, [ebp - 0x7f8]
push eax
call fcn.00448900
lea eax, [ebp - 0xed0]
mov byte [ebp - 4], 0x56
push eax
lea ecx, [ebp - 0x7f8]
call fcn.005d2b40
mov edi, eax
lea ecx, [ebp - 0x7f8]
lea eax, [ebp - 0xed8]
push eax
call fcn.005d2b60
mov esi, eax
lea ecx, [ebp - 0x7f8]
lea eax, [ebp - 0xedc]
push eax
call fcn.005d2b40
push fcn.0066edfe
push dword [edi]
push dword [esi]
push dword [eax]
lea eax, [ebp - 0xee0]
push eax
call fcn.005d20d0
mov eax, dword [ebp - 0xec4]
add esp, 0x14
mov esi, dword [eax]
mov dword [ebp - 0xed0], esi
cmp esi, eax
je 0x5d0c7e
nop word [eax + eax]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x828]
call fcn.005a7d30
lea eax, [ebp - 0xee0]
mov byte [ebp - 4], 0x57
push eax
lea ecx, [ebp - 0x828]
call fcn.005d2b40
mov ebx, eax
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0xedc]
push eax
call fcn.005d2b60
mov edi, eax
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0xed8]
push eax
call fcn.005d2b40
push fcn.0066edfe
push dword [ebx]
push dword [edi]
push dword [eax]
lea eax, [ebp - 0xee4]
push eax
call fcn.005d20d0
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.005d19b0
add esp, 0x1c
test al, al
jne 0x5d0e15
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x56
call fcn.00448860
lea ecx, [ebp - 0xed0]
call fcn.005d2350
mov esi, dword [ebp - 0xed0]
cmp esi, dword [ebp - 0xec4]
jne 0x5d0bd0
lea eax, [ebp - 0xebc]
push eax
push dword [ebp - 0xed4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x5d0e67
nop dword [eax + eax]
push 0x3e8
lea eax, [ebp - 0xe98]
push eax
lea eax, [ebp - 0x3f8]
push eax
call fcn.0066ece0
add esp, 0xc
lea eax, [ebp - 0x3f8]
lea ecx, [ebp - 0x858]
push eax
call fcn.00448900
lea eax, [ebp - 0xee4]
mov byte [ebp - 4], 0x58
push eax
lea ecx, [ebp - 0x858]
call fcn.005d2b40
mov edi, eax
lea ecx, [ebp - 0x858]
lea eax, [ebp - 0xee0]
push eax
call fcn.005d2b60
mov esi, eax
lea ecx, [ebp - 0x858]
lea eax, [ebp - 0xedc]
push eax
call fcn.005d2b40
push fcn.0066edfe
push dword [edi]
push dword [esi]
push dword [eax]
lea eax, [ebp - 0xed8]
push eax
call fcn.005d20d0
mov eax, dword [ebp - 0xec4]
add esp, 0x14
mov esi, dword [eax]
mov dword [ebp - 0xed0], esi
cmp esi, eax
je 0x5d0dea
nop dword [eax + eax]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x828]
call fcn.005a7d30
lea eax, [ebp - 0xee8]
mov byte [ebp - 4], 0x59
push eax
lea ecx, [ebp - 0x828]
call fcn.005d2b40
mov ebx, eax
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0xeec]
push eax
call fcn.005d2b60
mov edi, eax
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0xef0]
push eax
call fcn.005d2b40
push fcn.0066edfe
push dword [ebx]
push dword [edi]
push dword [eax]
lea eax, [ebp - 0xec8]
push eax
call fcn.005d20d0
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.005d19b0
add esp, 0x1c
test al, al
jne 0x5d0e37
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x58
call fcn.00448860
lea ecx, [ebp - 0xed0]
call fcn.005d2350
mov esi, dword [ebp - 0xed0]
cmp esi, dword [ebp - 0xec4]
jne 0x5d0d40
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0x56
call fcn.00448860
lea eax, [ebp - 0xebc]
push eax
push dword [ebp - 0xed4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5d0ca0
jmp 0x5d0e67
push dword [ebp - 0xed4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x28
mov ecx, 0x74e3a4
push esi
call fcn.00448830
lea ecx, [ebp - 0x828]
jmp 0x5d0e62
push dword [ebp - 0xed4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x28
mov ecx, 0x74e3a4
push esi
call fcn.00448830
lea ecx, [ebp - 0x828]
call fcn.00448860
lea ecx, [ebp - 0x858]
call fcn.00448860
lea ecx, [ebp - 0x7f8]
call fcn.00448860
lea ecx, [ebp - 0xec4]
call fcn.005d22a0
mov eax, 0x74e3a4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00663ada
mov esp, ebp
pop ebp
ret
push 0x7546b0
call fcn.00663c7a
add esp, 4
cmp dword [0x7546b0], 0xffffffff
jne 0x5cf38e
push 0x699180
call fcn.006640af
push 0x7546b0
call fcn.00663c30
add esp, 8
jmp 0x5cf38e
call fcn.0066a5fb
int3