Function at 0x445a90
Capabilities:
Enumerate processes
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5995ec
mov eax, dword fs:[0]
push eax
sub esp, 0xe28
mov eax, dword [0x6204e0]
xor eax, esp
mov dword [esp + 0xe20], eax
push ebx
push esi
push edi
mov eax, dword [0x6204e0]
xor eax, esp
push eax
lea eax, [esp + 0xe38]
mov dword fs:[0], eax
xor ebx, ebx
test byte [0x620db0], 1
mov edi, 0xf
jne 0x445b06
or dword [0x620db0], 1
push 0x59e3f0
mov dword [0x620dac], edi
mov dword [0x620da8], ebx
mov byte [0x620d98], bl
call fcn.0058effd
add esp, 4
cmp byte [0x6187f2], bl
je 0x4492cb
lea eax, [esp + 0x7b]
push eax
lea ecx, [esp + 0x7f]
push ecx
lea ecx, [esp + 0x60]
call fcn.0044a9f0
push 9
push str.Kaspersky
lea ecx, [esp + 0x3e0]
mov dword [esp + 0xe48], ebx
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 7
push str.avp.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 1
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 2
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 3
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 4
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
mov esi, 0x10
cmp dword [esp + 0x3d4], esi
jb 0x445c05
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x445c3a
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 9
push str.Kaspersky
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 9
push str.avpui.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 5
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 6
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 7
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 8
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x445d0e
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x445d43
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 6
push str.Norton
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 7
push str.nav.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 9
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0xa
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0xb
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xc
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x445e17
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x445e4c
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 6
push str.Norton
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 6
push str.ns.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0xd
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0xe
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0xf
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x10
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x445f20
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x445f55
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 6
push str.Norton
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 0x12
push str.nortonsecurity.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x11
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x12
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x13
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x14
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446029
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44605e
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 6
push str.Norton
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 0xc
push str.nswscsvc.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x15
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x16
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x17
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x18
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446132
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446167
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 3
push 0x5a42a4
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 8
push str.ekrn.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x19
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x1a
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x1b
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x1c
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x44623b
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446270
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 3
push 0x5a42a4
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 8
push str.egui.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x1d
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x1e
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x1f
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x20
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446344
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446379
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 3
push 0x5a42a4
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x3f8], edi
mov dword [esp + 0x3f4], ebx
mov byte [esp + 0x3e4], bl
call fcn.0040bad0
push 0xd
push str.eguiproxy.exe
lea ecx, [esp + 0x3c4]
mov byte [esp + 0xe48], 0x21
mov dword [esp + 0x3dc], edi
mov dword [esp + 0x3d8], ebx
mov byte [esp + 0x3c8], bl
call fcn.0040bad0
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x22
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x23
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x24
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x44644d
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446482
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.Avast
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.avastsvc.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x25
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x26
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x27
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x28
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446528
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44655d
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.McAfee
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.mcshield.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x29
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x2a
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x2b
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x2c
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446603
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446638
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.Comodo
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.cavwp.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x2d
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x2e
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x2f
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x30
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x4466de
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446713
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.Comodo
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.dragon_updater.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x31
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x32
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x33
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x34
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x4467b9
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4467ee
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.Comodo
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.cis.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x35
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x36
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x37
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x38
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446894
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4468c9
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.Comodo
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.cmdagent.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x39
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x3a
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x3b
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x3c
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x44696f
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4469a4
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.Panda
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.psuamain.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x3d
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x3e
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x3f
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x40
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446a4a
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446a7f
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.Panda
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.PSUAConsole.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x41
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x42
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x43
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x44
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446b25
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446b5a
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.Avira
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.avguard.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x45
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x46
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x47
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x48
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446c00
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446c35
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.dwengine.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x49
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x4a
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x4b
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x4c
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446cdb
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446d10
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.dwarkdaemon.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x4d
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x4e
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x4f
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x50
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446db6
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446deb
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.dwantispam.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x51
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x52
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x53
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x54
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446e91
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446ec6
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.dwservice.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x55
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x56
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x57
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x58
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x446f6c
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x446fa1
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.dwnetfilter.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x59
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x5a
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x5b
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x5c
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x447047
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44707c
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.DrWeb
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.dwwatcher.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x5d
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x5e
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x5f
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x60
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x447122
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447157
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 0x5a4164
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.avgidsagent.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x61
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x62
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x63
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x64
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x4471fd
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447232
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 0x5a4164
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.avgToolsSvc.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x65
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x66
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x67
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x68
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x4472d8
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44730d
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 0x5a4164
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.AVGUI.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x69
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x6a
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x6b
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x6c
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x4473b3
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4473e8
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 0x5a4164
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.aswEngSrv.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x6d
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x6e
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x6f
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x70
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x44748e
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4474c3
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 0x5a4164
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.wsc_proxy.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x71
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x72
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x73
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x74
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x447569
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44759e
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push 0x5a4164
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.AVGSvc.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x75
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x76
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x77
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x78
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x447644
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447679
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.coreserviceshell.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x79
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x7a
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x7b
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x7c
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x44771f
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x447754
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.uiWatchDog.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x7d
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x7e
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x7f
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x80
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x4477fa
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44782f
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.Tmsalnstance64.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x81
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x82
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x83
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x84
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x4478d5
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x44790a
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.AMSPTelemetryService.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x85
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe48], 0x86
call fcn.0044a250
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe44], 0x87
call fcn.0044a580
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x88
call fcn.0044b9a0
lea ecx, [esp + 0x7c]
call fcn.0046a590
lea ecx, [esp + 0x20]
call fcn.0046a590
cmp dword [esp + 0x3d4], esi
jb 0x4479b0
mov eax, dword [esp + 0x3c0]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3d4], edi
mov dword [esp + 0x3d0], ebx
mov byte [esp + 0x3c0], bl
mov byte [esp + 0xe40], bl
cmp dword [esp + 0x3f0], esi
jb 0x4479e5
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push str.TrendMicro
lea ecx, [esp + 0x3dc]
call fcn.0040c090
push str.coreFrameworkHost.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x89
call fcn.0040c090
lea edx, [esp + 0x3d8]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x8a
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x8b
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x8c
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x3bc]
call fcn.0040b300
lea ecx, [esp + 0x3d8]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.BitDefender
lea ecx, [esp + 0x414]
call fcn.0040c090
push str.bdagent.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x8d
call fcn.0040c090
lea eax, [esp + 0x410]
push eax
lea ecx, [esp + 0x3c0]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x8e
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x8f
call fcn.0044a580
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x90
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x3bc]
call fcn.0040b300
lea ecx, [esp + 0x410]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.BitDefender
lea ecx, [esp + 0x3f8]
call fcn.0040c090
mov byte [esp + 0xe40], 0x91
push str.gziface.exe
lea ecx, [esp + 0x3c0]
call fcn.0040c090
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x3c0]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x92
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x93
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x94
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x3bc]
call fcn.0040b300
lea ecx, [esp + 0x3f4]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.BitDefender
lea ecx, [esp + 0x348]
call fcn.0040c090
push str.ProductAgentService.exe
lea ecx, [esp + 0x3c0]
mov byte [esp + 0xe44], 0x95
call fcn.0040c090
lea edx, [esp + 0x344]
push edx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x96
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x97
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x98
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x3bc]
call fcn.0040b300
lea ecx, [esp + 0x344]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.BitDefender
lea ecx, [esp + 0x188]
call fcn.0040c090
push str.vsservppl.exe
lea ecx, [esp + 0x348]
mov byte [esp + 0xe44], 0x99
call fcn.0040c090
mov byte [esp + 0xe40], 0x9a
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x348]
push ecx
lea ecx, [esp + 0xd0]
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x9b
call fcn.0044a580
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0x9c
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x344]
call fcn.0040b300
lea ecx, [esp + 0x184]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.BitDefender
lea ecx, [esp + 0x310]
call fcn.0040c090
push str.bdredline.exe
lea ecx, [esp + 0x188]
mov byte [esp + 0xe44], 0x9d
call fcn.0040c090
lea ecx, [esp + 0x30c]
push ecx
lea edx, [esp + 0x188]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0x9e
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0x9f
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xa0
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x184]
call fcn.0040b300
lea ecx, [esp + 0x30c]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.BitDefender
lea ecx, [esp + 0x1c0]
call fcn.0040c090
push str.vsserv.exe
lea ecx, [esp + 0x310]
mov byte [esp + 0xe44], 0xa1
call fcn.0040c090
lea edx, [esp + 0x1bc]
push edx
lea eax, [esp + 0x310]
mov byte [esp + 0xe44], 0xa2
push eax
lea ecx, [esp + 0xd0]
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xa3
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xa4
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x30c]
call fcn.0040b300
lea ecx, [esp + 0x1bc]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.BitDefender
lea ecx, [esp + 0x380]
call fcn.0040c090
push str.updatesrv.exe
lea ecx, [esp + 0x1c0]
mov byte [esp + 0xe44], 0xa5
call fcn.0040c090
lea eax, [esp + 0x37c]
push eax
lea ecx, [esp + 0x1c0]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xa6
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xa7
call fcn.0044a580
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xa8
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x1bc]
call fcn.0040b300
lea ecx, [esp + 0x37c]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.MalwareBytes
lea ecx, [esp + 0x1f8]
call fcn.0040c090
push str.mbamservice.exe
lea ecx, [esp + 0x380]
mov byte [esp + 0xe44], 0xa9
call fcn.0040c090
lea ecx, [esp + 0x1f4]
push ecx
lea edx, [esp + 0x380]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xaa
call fcn.0044a250
mov byte [esp + 0xe40], 0xab
push eax
lea ecx, [esp + 0x24]
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xac
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x37c]
call fcn.0040b300
lea ecx, [esp + 0x1f4]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Clamav
lea ecx, [esp + 0x134]
call fcn.0040c090
push str.freshclam.exe
lea ecx, [esp + 0x1f8]
mov byte [esp + 0xe44], 0xad
call fcn.0040c090
lea edx, [esp + 0x130]
push edx
lea eax, [esp + 0x1f8]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xae
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xaf
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xb0
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x1f4]
call fcn.0040b300
lea ecx, [esp + 0x130]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Clamav
lea ecx, [esp + 0x230]
call fcn.0040c090
push str.freshclamwrap.exe
lea ecx, [esp + 0x134]
mov byte [esp + 0xe44], 0xb1
call fcn.0040c090
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x134]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xb2
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xb3
call fcn.0044a580
lea edx, [esp + 0x20]
mov byte [esp + 0xe40], 0xb4
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x130]
call fcn.0040b300
lea ecx, [esp + 0x22c]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.GData
lea ecx, [esp + 0x364]
call fcn.0040c090
push str.gdscan.exe
lea ecx, [esp + 0x230]
mov byte [esp + 0xe44], 0xb5
call fcn.0040c090
lea ecx, [esp + 0x360]
push ecx
lea edx, [esp + 0x230]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xb6
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xb7
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xb8
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x22c]
call fcn.0040b300
lea ecx, [esp + 0x360]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Emsisoft
lea ecx, [esp + 0x268]
call fcn.0040c090
push str.a2start.exe
lea ecx, [esp + 0x364]
mov byte [esp + 0xe44], 0xb9
call fcn.0040c090
lea edx, [esp + 0x264]
push edx
lea eax, [esp + 0x364]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xba
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xbb
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xbc
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x360]
call fcn.0040b300
lea ecx, [esp + 0x264]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push 0x5a3f9c
lea ecx, [esp + 0x39c]
call fcn.0040c090
push str.k7tsecurity.exe
lea ecx, [esp + 0x268]
mov byte [esp + 0xe44], 0xbd
call fcn.0040c090
lea eax, [esp + 0x398]
push eax
lea ecx, [esp + 0x268]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xbe
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xbf
call fcn.0044a580
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xc0
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x264]
call fcn.0040b300
lea ecx, [esp + 0x398]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push 0x5a3f9c
lea ecx, [esp + 0x2a0]
call fcn.0040c090
push str.k7tsmain.exe
lea ecx, [esp + 0x39c]
mov byte [esp + 0xe44], 0xc1
call fcn.0040c090
lea ecx, [esp + 0x29c]
push ecx
lea edx, [esp + 0x39c]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xc2
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xc3
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xc4
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x398]
call fcn.0040b300
lea ecx, [esp + 0x29c]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.TrustPort
lea ecx, [esp + 0x32c]
call fcn.0040c090
push str.tpeasy.exe
lea ecx, [esp + 0x2a0]
mov byte [esp + 0xe44], 0xc5
call fcn.0040c090
lea edx, [esp + 0x328]
push edx
lea eax, [esp + 0x2a0]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xc6
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xc7
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xc8
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x29c]
call fcn.0040b300
lea ecx, [esp + 0x328]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Vipre
lea ecx, [esp + 0x2d8]
call fcn.0040c090
push str.vipreui.exe
lea ecx, [esp + 0x32c]
mov byte [esp + 0xe44], 0xc9
call fcn.0040c090
lea eax, [esp + 0x2d4]
push eax
lea ecx, [esp + 0x32c]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xca
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xcb
call fcn.0044a580
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xcc
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x328]
call fcn.0040b300
lea ecx, [esp + 0x2d4]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Q360
lea ecx, [esp + 0x150]
call fcn.0040c090
push str.qhactivedefense.exe
lea ecx, [esp + 0x2d8]
mov byte [esp + 0xe44], 0xcd
call fcn.0040c090
lea ecx, [esp + 0x14c]
push ecx
lea edx, [esp + 0x2d8]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xce
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xcf
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xd0
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x2d4]
call fcn.0040b300
lea ecx, [esp + 0x14c]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Q360
lea ecx, [esp + 0x16c]
call fcn.0040c090
push str.qhsafetray.exe
lea ecx, [esp + 0x150]
mov byte [esp + 0xe44], 0xd1
call fcn.0040c090
lea edx, [esp + 0x168]
push edx
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xd2
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xd3
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xd4
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x14c]
call fcn.0040b300
lea ecx, [esp + 0x168]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Q360
lea ecx, [esp + 0x1a4]
call fcn.0040c090
mov byte [esp + 0xe40], 0xd5
push str.qhwatchdog.exe
lea ecx, [esp + 0x16c]
call fcn.0040c090
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x16c]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xd6
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xd7
call fcn.0044a580
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xd8
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x168]
call fcn.0040b300
lea ecx, [esp + 0x1a0]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Q360
lea ecx, [esp + 0x1dc]
call fcn.0040c090
push str.liveupdate360.exe
lea ecx, [esp + 0x1a4]
mov byte [esp + 0xe44], 0xd9
call fcn.0040c090
lea ecx, [esp + 0x1d8]
push ecx
lea edx, [esp + 0x1a4]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xda
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xdb
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xdc
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x1a0]
call fcn.0040b300
lea ecx, [esp + 0x1d8]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Q360
lea ecx, [esp + 0x214]
call fcn.0040c090
push str.360tsliveupd.exe
lea ecx, [esp + 0x1dc]
mov byte [esp + 0xe44], 0xdd
call fcn.0040c090
lea edx, [esp + 0x210]
mov byte [esp + 0xe40], 0xde
push edx
lea eax, [esp + 0x1dc]
push eax
lea ecx, [esp + 0xd0]
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xdf
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xe0
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x1d8]
call fcn.0040b300
lea ecx, [esp + 0x210]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.AdBlocker
lea ecx, [esp + 0x24c]
call fcn.0040c090
push str.adblockerultimategui.exe
lea ecx, [esp + 0x214]
mov byte [esp + 0xe44], 0xe1
call fcn.0040c090
lea eax, [esp + 0x248]
push eax
lea ecx, [esp + 0x214]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xe2
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xe3
call fcn.0044a580
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xe4
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x210]
call fcn.0040b300
lea ecx, [esp + 0x248]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.AdLock
lea ecx, [esp + 0x284]
call fcn.0040c090
push str.adlock.exe
lea ecx, [esp + 0x24c]
mov byte [esp + 0xe44], 0xe5
call fcn.0040c090
lea ecx, [esp + 0x280]
push ecx
lea edx, [esp + 0x24c]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xe6
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xe7
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xe8
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x248]
call fcn.0040b300
lea ecx, [esp + 0x280]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Ghostery
lea ecx, [esp + 0x2bc]
call fcn.0040c090
push str.ghostery_midnight.exe
lea ecx, [esp + 0x284]
mov byte [esp + 0xe44], 0xe9
call fcn.0040c090
lea edx, [esp + 0x2b8]
push edx
lea eax, [esp + 0x284]
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xea
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xeb
call fcn.0044a580
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xec
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x280]
call fcn.0040b300
lea ecx, [esp + 0x2b8]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Microsoft
lea ecx, [esp + 0x2f4]
call fcn.0040c090
push str.msmpeng.exe
lea ecx, [esp + 0x2bc]
mov byte [esp + 0xe44], 0xed
call fcn.0040c090
lea eax, [esp + 0x2f0]
push eax
lea ecx, [esp + 0x2bc]
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xee
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xef
call fcn.0044a580
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xf0
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x2b8]
call fcn.0040b300
lea ecx, [esp + 0x2f0]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push str.Microsoft
lea ecx, [esp + 0x80]
call fcn.0040c090
push str.msseces.exe
lea ecx, [esp + 0x2f4]
mov byte [esp + 0xe44], 0xf1
call fcn.0040c090
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x2f4]
push edx
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe48], 0xf2
call fcn.0044a250
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xe44], 0xf3
call fcn.0044a580
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xe48], 0xf4
call fcn.0044b9a0
lea ecx, [esp + 0x20]
call fcn.0046a590
lea ecx, [esp + 0xc8]
call fcn.0046a590
lea ecx, [esp + 0x2f0]
call fcn.0040b300
lea ecx, [esp + 0x7c]
mov byte [esp + 0xe40], bl
call fcn.0040b300
push ebx
push 2
mov dword [esp + 0x434], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0xbc], eax
cmp eax, ebx
je 0x4492b7
lea edx, [esp + 0x42c]
push edx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4492b7
push 0x3e8
lea eax, [esp + 0x454]
push eax
lea ecx, [esp + 0x664]
push ecx
call sub.MSVCR90.dll_wcstombs
add esp, 0xc
lea edx, [esp + 0x65c]
push edx
lea ecx, [esp + 0x3dc]
call fcn.0040c090
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x3dc]
mov byte [esp + 0xe44], 0xf5
call fcn.00418330
lea ecx, [esp + 0x110]
push ecx
lea ecx, [esp + 0x3dc]
mov edi, eax
call fcn.00418370
lea edx, [esp + 0x108]
push edx
lea ecx, [esp + 0x3dc]
mov dword [esp + 0xc4], eax
call fcn.00418330
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push sub.MSVCR90.dll_tolower
push ecx
mov ecx, dword [esp + 0xc8]
push edx
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x13c]
push ecx
call fcn.0044a070
mov edx, dword [esp + 0x90]
mov eax, dword [edx]
mov ecx, dword [esp + 0x78]
add esp, 0x20
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb4], ecx
jmp 0x448d60
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0xc0]
push ecx
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc8], edx
mov dword [esp + 0xc4], eax
call fcn.0046a390
test al, al
je 0x448ee7
lea ecx, [esp + 0xb4]
call fcn.00449b90
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x3c8]
mov dword [esp + 0x3e0], 0xf
mov dword [esp + 0x3dc], ebx
mov byte [esp + 0x3cc], bl
call fcn.0040b880
mov eax, dword [esp + 0x3c0]
mov byte [esp + 0xe40], 0xf6
cmp dword [esp + 0x3d4], esi
jae 0x448de6
lea eax, [esp + 0x3c0]
mov edx, dword [esp + 0x3d0]
lea ecx, [esp + 0x3bc]
push ecx
add eax, edx
push eax
lea ecx, [esp + 0x108]
call fcn.00417a40
lea edx, [esp + 0x118]
push edx
lea ecx, [esp + 0x3c0]
call fcn.00418330
mov edi, eax
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x3c0]
call fcn.00418330
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push sub.MSVCR90.dll_tolower
push ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x124]
push eax
call fcn.0044a070
lea ecx, [esp + 0x3f8]
push ecx
lea edx, [esp + 0x3e0]
push edx
call fcn.0040b1d0
add esp, 0x28
test al, al
jne 0x448e9f
lea ecx, [esp + 0x3bc]
mov byte [esp + 0xe40], 0xf5
call fcn.0040b300
lea ecx, [esp + 0xb4]
call fcn.004359c0
jmp 0x448d60
mov eax, dword [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xb4]
call fcn.00449b90
push 0xffffffffffffffff
add eax, 0x1c
push ebx
push eax
mov ecx, 0x620d94
call fcn.0040b880
lea ecx, [esp + 0x3bc]
call fcn.0040b300
lea ecx, [esp + 0x3d8]
call fcn.0040b300
jmp 0x4492b7
mov edx, dword [esp + 0xbc]
lea ecx, [esp + 0x42c]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x449285
jmp 0x448f10
push 0x3e8
lea eax, [esp + 0x454]
push eax
lea ecx, [esp + 0xa4c]
push ecx
call sub.MSVCR90.dll_wcstombs
add esp, 0xc
lea edx, [esp + 0xa44]
push edx
lea ecx, [esp + 0x414]
call fcn.0040c090
mov eax, dword [esp + 0x414]
mov byte [esp + 0xe40], 0xf7
cmp dword [esp + 0x428], esi
jae 0x448f60
lea eax, [esp + 0x414]
lea ecx, [esp + 0x410]
push ecx
push eax
lea ecx, [esp + 0x108]
call fcn.00417a40
mov eax, dword [esp + 0x414]
cmp dword [esp + 0x428], esi
jae 0x448f8c
lea eax, [esp + 0x414]
mov edx, dword [esp + 0x424]
lea ecx, [esp + 0x410]
push ecx
add eax, edx
push eax
lea ecx, [esp + 0x130]
call fcn.00417a40
mov eax, dword [esp + 0x414]
cmp dword [esp + 0x428], esi
jae 0x448fc1
lea eax, [esp + 0x414]
lea edx, [esp + 0x410]
push edx
push eax
lea ecx, [esp + 0x128]
call fcn.00417a40
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0x12c]
push sub.MSVCR90.dll_tolower
push eax
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x130]
push edx
mov edx, dword [esp + 0x130]
push eax
push ecx
push edx
lea eax, [esp + 0x3d0]
push eax
call fcn.0044a070
mov ecx, dword [esp + 0x90]
mov edx, dword [ecx]
mov eax, dword [esp + 0x78]
add esp, 0x20
mov dword [esp + 0xb8], edx
mov dword [esp + 0xb4], eax
jmp 0x449040
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0x70]
cmp eax, ebx
je 0x449055
cmp eax, dword [esp + 0x58]
je 0x449061
call sub.MSVCR90.dll__invalid_parameter_noinfo
mov eax, dword [esp + 0xb4]
cmp dword [esp + 0xb8], edi
je 0x44922e
cmp eax, ebx
jne 0x449227
call sub.MSVCR90.dll__invalid_parameter_noinfo
xor eax, eax
mov ecx, dword [esp + 0xb8]
cmp ecx, dword [eax + 0x18]
jne 0x44908e
call sub.MSVCR90.dll__invalid_parameter_noinfo
mov edi, dword [esp + 0xb8]
push 0xffffffffffffffff
lea eax, [edi + 0xc]
push ebx
push eax
lea ecx, [esp + 0x400]
mov dword [esp + 0x418], 0xf
mov dword [esp + 0x414], ebx
mov byte [esp + 0x404], bl
call fcn.0040b880
mov eax, dword [esp + 0x3f8]
mov byte [esp + 0xe40], 0xf8
cmp dword [esp + 0x40c], esi
jae 0x4490e0
lea eax, [esp + 0x3f8]
lea edx, [esp + 0x3f4]
push edx
push eax
lea ecx, [esp + 0x110]
call fcn.00417a40
mov eax, dword [esp + 0x3f8]
cmp dword [esp + 0x40c], esi
jae 0x44910c
lea eax, [esp + 0x3f8]
mov ecx, dword [esp + 0x408]
lea edx, [esp + 0x3f4]
add eax, ecx
push edx
push eax
lea ecx, [esp + 0x118]
call fcn.00417a40
mov eax, dword [esp + 0x3f8]
cmp dword [esp + 0x40c], esi
jae 0x449141
lea eax, [esp + 0x3f8]
lea ecx, [esp + 0x3f4]
push ecx
push eax
lea ecx, [esp + 0x120]
call fcn.00417a40
mov ecx, dword [esp + 0x10c]
mov byte [esp + 0xc0], bl
mov edx, dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
push edx
mov edx, dword [esp + 0x10c]
push eax
mov eax, dword [esp + 0x11c]
push sub.MSVCR90.dll_tolower
push ecx
mov ecx, dword [esp + 0x12c]
push edx
push eax
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00449ef0
mov eax, dword [esp + 0x434]
add esp, 0x20
cmp dword [esp + 0x428], esi
jae 0x4491b6
lea eax, [esp + 0x414]
mov ecx, dword [esp + 0x424]
mov edx, dword [esp + 0x408]
push ecx
push eax
push edx
push ebx
lea ecx, [esp + 0x404]
call fcn.0040a5a0
test eax, eax
je 0x4492f4
mov byte [esp + 0xe40], 0xf7
cmp dword [esp + 0x40c], esi
jb 0x4491fd
mov eax, dword [esp + 0x3f8]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0xb4]
mov dword [esp + 0x40c], 0xf
mov dword [esp + 0x408], ebx
mov byte [esp + 0x3f8], bl
call fcn.004359c0
jmp 0x449040
mov eax, dword [eax]
jmp 0x44907d
mov byte [esp + 0xe40], 0xf5
cmp dword [esp + 0x428], esi
jb 0x44924f
mov ecx, dword [esp + 0x414]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0xbc]
lea edx, [esp + 0x42c]
push edx
push eax
mov dword [esp + 0x430], 0xf
mov dword [esp + 0x42c], ebx
mov byte [esp + 0x41c], bl
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x448f10
cmp dword [esp + 0x3f0], esi
jb 0x44929e
mov edx, dword [esp + 0x3dc]
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3f0], 0xf
mov byte [esp + 0x3dc], bl
mov dword [esp + 0x3ec], ebx
lea ecx, [esp + 0x58]
mov dword [esp + 0xe40], 0xffffffff
call fcn.0044c180
mov eax, 0x620d94
mov ecx, dword [esp + 0xe38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe20]
xor ecx, esp
call fcn.0058ecc6
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xb4]
cmp eax, ebx
jne 0x4493b9
call sub.MSVCR90.dll__invalid_parameter_noinfo
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x449322
call sub.MSVCR90.dll__invalid_parameter_noinfo
push 0xffffffffffffffff
lea eax, [edi + 0x28]
push ebx
push eax
mov ecx, 0x620d94
call fcn.0040b880
cmp dword [esp + 0x40c], esi
jb 0x44934c
mov edx, dword [esp + 0x3f8]
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edi, 0xf
mov dword [esp + 0x40c], edi
mov dword [esp + 0x408], ebx
mov byte [esp + 0x3f8], bl
cmp dword [esp + 0x428], esi
jb 0x44937f
mov eax, dword [esp + 0x414]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x428], edi
mov dword [esp + 0x424], ebx
mov byte [esp + 0x414], bl
cmp dword [esp + 0x3f0], esi
jb 0x4493ad
mov ecx, dword [esp + 0x3dc]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x3f0], edi
jmp 0x4492a9
mov eax, dword [eax]
jmp 0x449318