Function at 0x1002db4f
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
sub esp, 0x808
mov eax, dword [0x10074bac]
xor eax, esp
mov dword [esp + 0x804], eax
call fcn.1002d87f
test al, al
jne 0x1002db73
xor eax, eax
jmp 0x1003048c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebp
push 0x3ff
mov dword [0x10144ee4], eax
xor edi, edi
lea eax, [esp + 0x19]
push edi
push eax
mov byte [0x10142648], 0
mov byte [esp + 0x20], 0
call fcn.10040850
add esp, 0xc
test dword [0x10144ef4], 0x80000000
je 0x1002dc3f
push edi
push str.tc_MENU_EXP_Time
mov ebx, str.SOFTWARETrojanCut_tc_Env
push ebx
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.1003d897
push edi
push str.tc_MENU_EXP_ID
push ebx
push esi
mov dword [0x1013ee6c], eax
call fcn.1003d897
add esp, 0x20
push 0xa
cdq
pop ecx
idiv ecx
mov dword [0x1013ee70], eax
call ebp
cmp eax, dword [0x1013ee6c]
jae 0x1002dc3f
mov eax, dword [0x1013ee70]
cmp eax, dword [0x1016e468]
je 0x1002dc23
cmp eax, dword [0x1016e46c]
je 0x1002dc23
cmp eax, dword [0x1016e470]
je 0x1002dc23
cmp eax, dword [0x1016e474]
je 0x1002dc23
cmp eax, dword [0x1016e478]
jne 0x1002dc3f
mov byte [0x10072497], 0
cmp dword [0x101434ac], edi
je 0x1002dc3f
push str.Ransom_Protect_Except
push edi
call fcn.1003dfed
pop ecx
pop ecx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.Progra
mov ebp, 0x10142448
push ebp
call ebx
cmp byte [0x10141790], 0
mov esi, 0x10141790
je 0x1002dd2d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002dc69
sub eax, edx
cmp eax, 3
jbe 0x1002dd2d
cmp dword [0x101434ac], edi
je 0x1002dc93
push esi
push ebp
push str.MyGetFileVersionInformation___s__s_
push edi
call fcn.1003dfed
add esp, 0x10
push esi
lea eax, [esp + 0x18]
push 0x10068e70
push eax
call fcn.10040b98
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push str.FB_MessengerMicrosoft_LyncMicrosoft_Lync_2010Skype_for_Businessi_Messenger_UCLanTalk.NET_MessengerBigAnt_MessengerCoolMessengerDaum
call ebx
test eax, eax
jne 0x1002dcc6
push str.CoolMessenger
lea eax, [esp + 0x18]
push eax
call ebx
test eax, eax
je 0x1002dcd0
mov dword [0x1029e3f4], 0x20000
lea eax, [esp + 0x14]
push eax
push str.NateOn_Messenger
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002dcef
mov dword [0x1029e3f8], 2
lea eax, [esp + 0x14]
push eax
push str.LINE
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002dd0e
mov dword [0x1029e3f8], 4
lea eax, [esp + 0x14]
push eax
push str.Skype_for_Business
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002dd2d
mov dword [0x1029e3f8], 8
push 0x1005fb94
mov esi, 0x10142848
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002ddbd
push str.TASKHOST.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002ddbd
push str.TASKENG.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002ddbd
push str.DWM.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002ddbd
test dword [0x10144688], 0x80000
je 0x1002dda3
push str.SYSTEM32SVCHOST.EXE
push ebp
call ebx
test eax, eax
jne 0x1002dd9a
push str.SysWOW64SVCHOST.EXE
push ebp
call ebx
test eax, eax
je 0x1002dda3
mov byte [0x10072cbb], 0
jmp 0x1002ddc4
test dword [0x10144688], 0x40000
je 0x1002ddc4
push str.SYSTEM32DLLHOST.EXE
push ebp
call ebx
test eax, eax
je 0x1002ddc4
jmp 0x1002dd9a
mov byte [0x10144ec1], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [esp + 0x10], eax
call fcn.1002dad4
cmp dword [esp + 0x10], 0
mov edi, 0x10143c88
je 0x1002de14
mov eax, dword [esp + 0x10]
cmp byte [eax], 0
je 0x1002de14
push str.rundll32.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002de14
push str.PhotoViewer.dll
push dword [esp + 0x14]
call ebx
test eax, eax
je 0x1002de14
mov byte [0x10072497], 0
jmp 0x1002e3a6
push str.OUTLOOK.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002de79
push str.OFFICE
push ebp
call ebx
test eax, eax
je 0x1002de79
xor eax, eax
inc eax
mov dword [0x10092cd8], eax
mov dword [0x10144ec8], eax
mov dword [0x101964a4], eax
mov byte [0x10072497], 0
call fcn.1002947a
cmp dword [0x101434ac], 0
mov byte [0x1013dc00], al
je 0x1002e4a1
movzx eax, al
push eax
push str.IsExchange___d_
push 0
call fcn.1003dfed
add esp, 0xc
jmp 0x1002e4a1
push str.NvContainer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002de96
push str.NVIDIA
push ebp
call ebx
test eax, eax
jne 0x1002def3
push 0x1006607c
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002debf
push str.WINDOWS
push ebp
call ebx
test eax, eax
je 0x1002debf
mov dword [0x10144ec8], 2
jmp 0x1002dee6
push 0x10066070
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002deff
push str.OUTLOOK
push ebp
call ebx
test eax, eax
je 0x1002deff
mov dword [0x10144ec8], 3
xor eax, eax
inc eax
mov dword [0x10092cd8], eax
mov dword [0x101964a4], eax
mov byte [0x10072497], 0
jmp 0x1002e4a1
push str.vmplayer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002df28
push str.VMware_Workstation
push ebp
call ebx
test eax, eax
je 0x1002df28
mov byte [0x10144eec], 1
jmp 0x1002e4a1
push str.SPOOLSV
push esi
call ebx
test eax, eax
je 0x1002df40
mov byte [0x10144ec2], 1
jmp 0x1002e4a1
push str.WLCOMM.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002df69
cmp dword [0x10072cd8], 0x501
jle 0x1002df69
mov byte [0x10144eed], 1
jmp 0x1002e4a1
push str.AcroRd32.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002df86
push str.ADOBE
push ebp
call ebx
test eax, eax
jne 0x1002dfa3
push str.Acrobat.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002dfae
push str.ADOBE
push ebp
call ebx
test eax, eax
je 0x1002dfae
mov byte [0x10072497], 0
push 0x10
jmp 0x1002e010
push str.WINWORD.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002dfd0
push str.Microsoft_Office
push ebp
call ebx
test eax, eax
je 0x1002dfd0
xor eax, eax
inc eax
jmp 0x1002e011
push 0x10065fa4
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002dff1
push str.Microsoft_Office
push ebp
call ebx
test eax, eax
je 0x1002dff1
push 4
jmp 0x1002e010
push 0x10065fb4
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e020
push str.Microsoft_Office
push ebp
call ebx
test eax, eax
je 0x1002e020
push 2
pop eax
mov dword [0x10144ed4], eax
mov dword [0x10144ee0], eax
jmp 0x1002e4a1
push str.HWP.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e04f
push str.Hnc
push ebp
call ebx
test eax, eax
je 0x1002e04f
push 8
pop eax
mov dword [0x10144ed4], eax
mov dword [0x10144ee0], eax
jmp 0x1002e3a6
push str.VISIO.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e06f
mov dword [0x10144ed4], 0x400
jmp 0x1002e4a1
push str.DEVENV.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e08f
mov dword [0x10144ed4], 0x60
jmp 0x1002e4a1
push str.MSSQL.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002e0e9
push str.sqlwriter.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e0cc
push str.Microsoft_SQL
push ebp
call ebx
test eax, eax
je 0x1002e0cc
mov dword [0x10144ed0], 0x20
jmp 0x1002e4a1
push str.sqlservr.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e0f8
push str.Microsoft_SQL
push ebp
call ebx
test eax, eax
je 0x1002e0f8
mov dword [0x10144ed4], 0x20
jmp 0x1002e4a1
push str.GROOVE.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e118
mov dword [0x10144ed4], 0x80
jmp 0x1002e4a1
push str.ONENOTE.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e13d
mov eax, 0x100
mov dword [0x10144ed4], eax
mov dword [0x10144ed8], eax
jmp 0x1002e4a1
push str.MSOSYNC.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e15d
mov dword [0x10144ed4], 0x200
jmp 0x1002e4a1
push str.XCOPY.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e17a
mov byte [0x10144ee8], 1
jmp 0x1002e4a1
push str.DDXBOT.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e197
mov byte [0x10144ee9], 1
jmp 0x1002e4a1
push 0x100600d0
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e1c5
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e1ad
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002e210
push str.powershell.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e1e2
push str.WindowsPowerShell
push ebp
call ebx
test eax, eax
jne 0x1002e210
push str.powershell_ise.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e1ff
push str.WindowsPowerShell
push ebp
call ebx
test eax, eax
jne 0x1002e210
push str.CONHOST.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e21c
mov byte [0x10144eea], 1
jmp 0x1002e4a1
push str.BROWSERPLUSCORE.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002e23e
push str.BROWSERPLUSSERVICE.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e24a
mov byte [0x10144eeb], 1
jmp 0x1002e4a1
push str.ALFTP.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e262
mov byte [0x10072497], al
jmp 0x1002e2c8
push str.FILEZILLA.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002e2c8
push str.FILEZILLA_Server.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002e2c8
push str.DAFTP.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002e2c8
push str.WINSCP.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002e2c8
push str.FLASHFXP.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002e2c8
push str.FTP.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e2d7
mov dword [0x1029e3f4], 0x400
jmp 0x1002e4a1
push esi
push str.FBMessenger.exeCommunicator.exeLYNC.EXEIMESSENGERUC.EXELINE.EXEKAKAOTALK.EXEwlcomm.exeUCware_m.exeNaverTalk.exeNaverT1.exeMyPeople.exeCoolMessenger.exeCoolMe1.exeNateOnMain.exeNateOn1.exeDame40.exemsnmsgr.exeYahooMessenger.exeYahooM1.exegoogletalk.exegoogle1.exeU2Messenger.exeU2Mess1.exeUniMSG.exe_Messenger.exeKuki.exeTachy.exeOnMate.exeMissleeMessenger.exeMissle1.exeActivePostGSuite.exeActive1.exeBigAnt.exeBuddyBuddy.exeICQ.exemiranda32.exemirand1.exeLanTalk.exeMessenger.exeMessen1.exeSkypeApp.exeSkype.exeNEOBIZBOX.EXENEOBIZ1.EXETELEGRAM.EXETEAMS.EXEWhatsApp.exeWeChat.exeViber.exeQQ.exe
call ebx
test eax, eax
je 0x1002e32c
push str.NateOnMain.exe
push esi
mov dword [0x1029e3f4], 0x20000
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e308
mov dword [0x10092cbc], 3
push str.U2Messenger.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e4a1
mov dword [0x10092cbc], 2
jmp 0x1002e4a1
push esi
push 0x10143248
call ebx
test eax, eax
je 0x1002e347
mov dword [0x1029e3f4], 0x20000
jmp 0x1002e4a1
push str.EZBUILDER.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002e369
push str.EZBUIL1.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e378
mov dword [0x1016e060], 0x12378923
jmp 0x1002e4a1
push str.ALZIP.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e3b2
push str.ESTsoft
push ebp
call ebx
test eax, eax
je 0x1002e3b2
mov byte [0x100724b2], 0
mov dword [0x1013f2e4], 1
mov byte [0x10072cbb], 0
jmp 0x1002e4a1
push str.BandiZip.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e3cf
push str.Bandizip
push ebp
call ebx
test eax, eax
jne 0x1002e437
push str.breadzip.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e3ec
push 0x1006863c
push ebp
call ebx
test eax, eax
jne 0x1002e437
push str.7z.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e409
push str.7_Zip
push ebp
call ebx
test eax, eax
jne 0x1002e437
push str.WinRAR.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e426
push str.WinRAR
push ebp
call ebx
test eax, eax
jne 0x1002e437
push str.WinZip.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e440
mov byte [0x100724b2], 0
jmp 0x1002e46e
push str.wermgr.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e47a
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e456
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
jne 0x1002e47a
mov dword [0x1013f2e4], 1
jmp 0x1002e4a1
push str.iTunes.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e4a1
push str.iTunes_
push ebp
call ebx
test eax, eax
je 0x1002e4a1
mov dword [0x1013f2e4], 2
push str.update.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e4c2
push str._teamviewer
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.teamviewer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e4e3
push str._teamviewer
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.kakaotalk.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e504
push str.kakao
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.gom.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e525
push str.gomplayer
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.devenv.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e546
push str.microsoft
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.hcellviewer.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e567
push str.hnc
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.werfault.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e588
push str.Windows
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.SYSTEM32MSIEXEC.EXE
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.SYSWOW64MSIEXEC.EXE
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.SETUP100.EXE
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.dotNetFx
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.IEExec.exe
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.Xshell.exe
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.XshellCore.exe
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.delfino_
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.sihost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e63a
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e61e
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.RuntimeBroker.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e68e
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e650
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
jne 0x1002e68e
mov esi, str.Metro
mov edi, 0x10142a48
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [0x10144edc], 0x100
mov edi, 0x10143c88
mov esi, 0x10142848
jmp 0x1002ea56
push str.browser_broker.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e6c0
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e6a4
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.pickerhost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e6f2
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e6d6
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.splwow64.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e72b
mov eax, 0x10144088
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e70b
sub eax, ecx
push eax
push ebp
push 0x10144088
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.rdrservicesupdater.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e74c
push str._adobe
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.taskhostw.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e77e
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e762
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.wbemwmiprvse.exe
push ebp
call ebx
test eax, eax
je 0x1002e796
push edi
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.fnplicensingservice.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e7b7
push str.macrovision_shared
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.defrag.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e7e9
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e7cd
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.vmware.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e80a
push str._vmware
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.vesmgr.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e82b
push str._sony
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.lineupdater.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e84c
push str.line
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.cleanmgr.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e87e
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e862
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.navermediaplayer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e89f
push str._naver_
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.kmplayer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e8c0
push str.kmplayer_
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.isdev.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e8e1
push str.installshield
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.compattelrunner.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e913
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e8f7
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.mrt.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e945
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e929
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.ShellExperienceHost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e972
push 0x10144088
push ebp
call ebx
test eax, eax
je 0x1002e972
push str.SystemApps_
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.SearchUI.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e99f
push 0x10144088
push ebp
call ebx
test eax, eax
je 0x1002e99f
push str.SystemApps_
push ebp
call ebx
test eax, eax
jne 0x1002ea56
push str.searchindexer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e9d1
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e9b5
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.SearchFilterHost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002e9ff
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e9e7
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.SearchProtocolHost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ea2d
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002ea15
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002ea56
push str.wsmprovhost.exe
push ebp
call ebx
test eax, eax
je 0x1002ea5d
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002ea3e
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
jne 0x1002ea5d
mov byte [0x10072497], 0
test dword [0x10144688], 0x2000000
je 0x1002f389
push str.SYSTEM32_
push ebp
call ebx
test eax, eax
jne 0x1002ea89
push str.SysWOW64_
push ebp
call ebx
test eax, eax
je 0x1002f389
push str.svchost.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002f382
push str.SERVICES.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002f382
push str.rundll32.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002f382
push str.DLLHOST.EXE
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002f382
push str.sdiagnhost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eb0f
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002eaf3
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002f382
push str.jusched.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eb30
push str.java_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.ndrive.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eb51
push str._naver_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.NDriveSVC.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eb72
push str._naver_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.NDSync.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eb93
push str._naver_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.googledrivesync.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ebb4
push str.Google_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.software_reporter_tool.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ebd5
push str.Google_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.Dropbox.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ebf6
push str.Dropbox_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.OneDrive.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ec17
push str.OneDrive_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.iCloud.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ec38
push str.Apple_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.iCloudDrive.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ec59
push str.Apple_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.iCloudPhotos.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ec7a
push str.Apple_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.iCloudServices.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ec9b
push str.Apple_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.iCloudWeb.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ecbc
push str.Apple_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.BoxSync.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ecdd
push str.Box_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.BoxSyncMonitor.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ecfe
push str.Box_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.SyncUpdaterService.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ed1f
push str.Box_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.vboxsvc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ed40
push str.oracle_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.CCleaner.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ed61
push str.CCleaner_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.CCleaner64.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ed82
push str.CCleaner_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.adobearm.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eda3
push str._adobe_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.illustrator.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002edc4
push str._adobe_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.i3gproc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ede5
push str.ipinside_lws_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.agent.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ee06
push str.Battle.net_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.anysign4pc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ee27
push str.SoftForum_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.aycagent.ayc
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ee48
push str.ESTsoft_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.cdas2pc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ee69
push str.Easy_Printer_Manager_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.giljabistart.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ee8a
push str.lg_swupdate_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.kiestrayagent.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eeab
push str.SAMSUNG_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.lsass.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eecc
push str.SYSTEM32lsass.EXE
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.natsvc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eeed
push str.NAT_SERVICE_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.ncleanservice.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ef0e
push str.Naver_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.nmindexstoresvr.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ef2f
push str.Ahead_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.pnp.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ef50
push str.lg_swupdate_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.setmuilanguage.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ef71
push str.Dell_DataSafe_Local_Backup_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.smartconnectortray.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ef92
push str.HYUNDAI_MNSOFT_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.smartupdateplustray.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002efb3
push str.HYUNDAI_MNSOFT_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.toaster.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002efd4
push str.Dell_DataSafe_Local_Backup_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.winnetplus.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002eff5
push str.FileNori_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.wiseturbo.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f016
push str.Wise_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.wudfhost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f037
push str.Windows_Driver_Foundation_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.photoshop.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f058
push str._adobe_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.acrobat.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f079
push str._adobe_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.quarkxpress.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f09a
push str.quark_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.software_reporter_tool.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f0bb
push str.chrome_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.taskhost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f0ed
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002f0d1
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002f382
push str.emule.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f10e
push str.emule_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.AppleMobileDeviceHelper.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f12f
push str.Apple_
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.potplayermini.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f150
push str.daum
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.Melon.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f171
push str.Melon
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.neroexpress.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f192
push str._nero
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.wireshark.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f1b3
push str.wireshark
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.itunes.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f1d4
push str.itunes
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.nateonupgrader.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f1f5
push str._nateon
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.dtlite.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f216
push str.daemon_tools
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.AYRTSrv.aye
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f237
push str.ALYac
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.ayupdsrv.aye
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f258
push str.ALYac
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.NateOnMain.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f279
push str.NATEON
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.nero.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f29a
push str._nero
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.shieldtrayui.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f2bb
push str._shield
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.hcell.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f2dc
push str.Hnc
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.hvrmalsvc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f2fd
push str.Hauri
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.wudfhost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f32b
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002f313
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002f382
push str.veraport.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f348
push str.WIZVERA
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.keysharpnxbiz.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f365
push str.keysharpnxbiz
push ebp
call ebx
test eax, eax
jne 0x1002f382
push str.StSess.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f389
push str.AhnLab
push ebp
call ebx
test eax, eax
je 0x1002f389
mov byte [0x10072497], 0
push 0x10067cf4
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f3aa
push str.ktedi
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.daumcleaner.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f3cb
push str.daum
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.appchecks.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f3ec
push str.AppCheck
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.google_photos_backup.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f40d
push str.google
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.nosstarter.npe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f42e
push str._nprotect
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.ie4uinit.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f460
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002f444
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002f869
push str.aycupdsrv.ayc
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f481
push str.estsoft
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.alsee.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f4a2
push str.estsoft
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.radeonsettings.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f4c3
push str._amd
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.adobegcclient.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f4e4
push str._adobe
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.nvcagent.npc
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f505
push str._naver
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.adobe_desktop_service.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f526
push str._adobe
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.acad.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f547
push str._autodesk
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.commainedi.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f568
push str.ktedi
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.RwVnSvc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f589
push str.AhnLab
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.ASDSvc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f5aa
push str.AhnLab
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.TSVNCache.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f5cb
push str.TortoiseSVN
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.PotPlayer64.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f5ec
push str.DAUM
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.PotPlayer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f60d
push str.DAUM
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.nsvmon.npc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f62e
push str.Naver
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.NvBackend.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f64f
push str.NVIDIA
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.mbamservice.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f670
push str.malwarebytes
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.tempCR_
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.au_.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f6a1
push str._appdata
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.rdrcef.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f6c2
push str._adobe
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.tspcscan2.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f6e3
push str._tcostream
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.tspcscanx64.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f704
push str._tcostream
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.vssvc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f736
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002f71a
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002f869
push str.magiclinembxsetup.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002f869
push str.samsungportablessd.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002f869
push str.q_dir.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1002f869
push str.setuphost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f796
push str._windows.bt_
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.systempropertiesremote.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f7c8
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002f7ac
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002f869
push str.systempropertiesprotection.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f7f6
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002f7de
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002f869
push str.systempropertiesadvanced.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f824
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002f80c
sub eax, ecx
push eax
push ebp
push edi
call fcn.10007447
add esp, 0xc
test eax, eax
je 0x1002f869
push ebp
call fcn.1002c2c2
pop ecx
test al, al
jne 0x1002f869
push str.wordpad.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f84c
push str.Windows_NT
push ebp
call ebx
test eax, eax
jne 0x1002f869
push str.pccleaner2service.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f870
push str._samsung
push ebp
call ebx
test eax, eax
je 0x1002f870
mov byte [0x10072497], 0
push str.geni_
push ebp
call ebx
test eax, eax
jne 0x1002f8a4
cmp dword [0x102a851c], eax
je 0x1002f8ad
push str._archiver.txr
push ebp
call ebx
test eax, eax
jne 0x1002f8a4
cmp dword [0x102a851c], eax
je 0x1002f8ad
push str.ransimlauncher.exe
push ebp
call ebx
test eax, eax
je 0x1002f8ad
mov byte [0x10072497], 0
jmp 0x1002f8e9
push str.TELEGRAM.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f8ca
mov dword [0x1029e3f8], 0x10
jmp 0x1002f8e9
cmp dword [0x1029e3f8], 0
jne 0x1002f8e9
push esi
push str.FBMessenger.exeCommunicator.exeLYNC.EXEIMESSENGERUC.EXELINE.EXEKAKAOTALK.EXEwlcomm.exeUCware_m.exeNaverTalk.exeNaverT1.exeMyPeople.exeCoolMessenger.exeCoolMe1.exeNateOnMain.exeNateOn1.exeDame40.exemsnmsgr.exeYahooMessenger.exeYahooM1.exegoogletalk.exegoogle1.exeU2Messenger.exeU2Mess1.exeUniMSG.exe_Messenger.exeKuki.exeTachy.exeOnMate.exeMissleeMessenger.exeMissle1.exeActivePostGSuite.exeActive1.exeBigAnt.exeBuddyBuddy.exeICQ.exemiranda32.exemirand1.exeLanTalk.exeMessenger.exeMessen1.exeSkypeApp.exeSkype.exeNEOBIZBOX.EXENEOBIZ1.EXETELEGRAM.EXETEAMS.EXEWhatsApp.exeWeChat.exeViber.exeQQ.exe
call ebx
test eax, eax
je 0x1002f8e9
mov dword [0x1029e3f8], 0xff000000
push str.microsoft
push ebp
call ebx
test eax, eax
je 0x1002f8fc
mov byte [0x100724b1], 0
push str.taskmgr.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f919
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.ApplicationFrameHost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f936
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.SettingSyncHost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f953
push edi
push ebp
call ebx
test eax, eax
jne 0x10030155
push str.logonui.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f970
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.powershell_ise.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f98d
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.mmc.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f9aa
push edi
push ebp
call ebx
test eax, eax
jne 0x10030155
push str.spoolsv.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f9c7
push edi
push ebp
call ebx
test eax, eax
jne 0x10030155
push str.devicecensus.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002f9e4
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.backgroundtaskhost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fa01
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.srtasks.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fa1e
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.provtool.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fa3b
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.narrator.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fa58
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.usocoreworker.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fa75
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.msdt.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fa92
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.remotefxvgpudisablement.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002faaf
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.ctfmon.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002facc
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.audiodg.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fae9
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.srtasks.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fb06
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.javaw.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fb23
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.mspaint.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fb40
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.regedit.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fb61
push 0x10144088
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.mousocoreworker.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fb82
push 0x10144088
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.windbg.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fba3
push str.windows
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.yourphone.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
mov edi, str.microsoft
test eax, eax
jne 0x1002fbc5
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.ngentask.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fbe2
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.yourphoneserver.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fc0e
push edi
push ebp
call ebx
test eax, eax
je 0x1002fc0e
mov byte [0x100724b0], 0
mov byte [0x10144eef], 1
jmp 0x10030163
push str.webviewhost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fc2b
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.lync.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fc48
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.skype.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fc65
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.msedgewebview2.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fc82
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.startmenuexperiencehost.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fc9f
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.solitaire.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fcbc
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.winstore.app.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fcd9
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.hxtsr.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fcf6
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.maps.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fd13
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.ngen.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fd30
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.gamebarftserver.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fd4d
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.onedrivesetup.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fd6a
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push 0x1005f9e0
push esi
call fcn.1000740e
pop ecx
pop ecx
mov edi, str.Mozilla_Firefox
test eax, eax
jne 0x1002fd8c
push edi
push ebp
call ebx
test eax, eax
jne 0x10030155
push str.helper.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fda9
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.maintenanceservice_installer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fdc6
push edi
push ebp
call ebx
test eax, eax
jne 0x100300bd
push str.pccleaner2app.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fde7
push str.pccleaner2app
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.suengine.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
mov edi, str._samsung
test eax, eax
jne 0x1002fe09
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.samsungnotes.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fe26
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.pc_gallery.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fe43
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.linksharingapp.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fe60
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.samsungbluetoothsync.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fe7d
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.kieshelper.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fe9a
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.sservice_uwa.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002feb7
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.isdev.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fed8
push str.installshield
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.breadzip.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fef9
push 0x1006863c
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.melonntfy2.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ff1a
push str.melon
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.skype.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ff3b
push str._skype
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.utorrent.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
mov edi, str.utorrent
test eax, eax
jne 0x1002ff5d
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.utorrentie.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ff7a
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.bittorrent.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ff9b
push str._bittorrent
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.helper.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ffb8
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.gom.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002ffd9
push str.gomplayer
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.softwareupdate.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002fffa
push str._apple
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.linelauncher.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
mov edi, str.line
test eax, eax
jne 0x10030024
push edi
push ebp
call ebx
test eax, eax
je 0x10030024
mov byte [0x10072497], 0
jmp 0x10030163
push str.line.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x10030041
push edi
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.teamviewer.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x10030062
push str._teamviewer
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.agent.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x10030083
push str._flexnet
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.drivertoolkit.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x100300a4
push str.drivertoolkit
push ebp
call ebx
test eax, eax
jne 0x1003015c
push str.linelauncher.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x100300c9
push edi
push ebp
call ebx
test eax, eax
je 0x100300c9
mov byte [0x100724b0], 0
jmp 0x10030163
push str.spotify.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x100300e6
push str._spotify
push ebp
call ebx
test eax, eax
jne 0x10030155
push str.procexp.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x10030155
push str.procexp64.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x10030155
push str.procmon.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x10030155
push str.procmon64.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x10030155
push str.depends.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1003015c
push str.kmp_
push esi
call ebx
test eax, eax
jne 0x1003015c
mov byte [0x100724b0], 0
mov byte [0x100724b1], 0
push str.C:Program_FilesCodeGearRAD_Studio.
call fcn.1003d654
test eax, eax
setne al
pop ecx
mov byte [0x1013ee5c], al
test al, al
jne 0x100301c3
push str.C:Program_Files__x86_CodeGearRAD_Studio.
call fcn.1003d654
test eax, eax
setne al
pop ecx
mov byte [0x1013ee5c], al
test al, al
jne 0x100301c3
push str.C:Program_FilesDelphi_bin.
call fcn.1003d654
test eax, eax
setne al
pop ecx
mov byte [0x1013ee5c], al
test al, al
jne 0x100301c3
push str.C:Program_Files__x86_Delphi_bin.
call fcn.1003d654
test eax, eax
setne al
pop ecx
mov byte [0x1013ee5c], al
test dword [0x1029e3f4], 0x400
je 0x100301d6
mov byte [0x10072497], 0
test dword [0x10144ef4], 0x20000000
je 0x100301f9
push ebp
call fcn.10018b22
pop ecx
mov byte [0x101400f7], al
test al, al
je 0x100301f9
mov byte [0x100724b3], 0
push 0x100654e4
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1003025f
push 0x100654d8
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1003025f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x3ff
mov edi, eax
lea eax, [esp + 0x419]
push 0
push eax
mov byte [esp + 0x420], 0
call fcn.10040850
push 0x1005ce9d
push 0x1005e680
lea eax, [esp + 0x428]
push eax
push edi
call fcn.1003cefb
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x414]
mov byte [eax + 0x1029dff0], cl
inc eax
test cl, cl
jne 0x100302a0
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.1004083f
add esp, 0x808
ret