Function at 0x10026740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4f5f
mov eax, dword fs:[0]
push eax
sub esp, 0x9c0
mov eax, dword [0x1011b600]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x9bc], edi
mov eax, dword [str.7z.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x9b8], xmm0
mov dword [ebp - 0x9b8], eax
movzx eax, word [0x1010d410]
mov dword [ebp - 0x9bc], edi
mov dword [ebp - 0x9a8], 6
mov dword [ebp - 0x9a4], 0xf
mov word [ebp - 0x9b4], ax
mov byte [ebp - 0x9b2], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1010d41c]
movups xmmword [ebp - 0x9a0], xmm0
mov dword [ebp - 0x998], eax
movzx eax, word [0x1010d420]
movq xmm0, qword [str.SublimeText.exe]
mov word [ebp - 0x994], ax
movzx eax, byte [0x1010d422]
mov dword [ebp - 0x990], 0xf
mov dword [ebp - 0x98c], 0xf
movq qword [ebp - 0x9a0], xmm0
mov byte [ebp - 0x992], al
mov byte [ebp - 0x991], 0
xorps xmm0, xmm0
mov dword [ebp - 0x978], 8
movups xmmword [ebp - 0x988], xmm0
mov dword [ebp - 0x974], 0xf
mov dword [ebp - 0x988], 0x6d6f7441
mov dword [ebp - 0x984], 0x6578652e
mov byte [ebp - 0x980], 0
mov byte [ebp - 4], 2
push 0x20
movups xmmword [ebp - 0x970], xmm0
mov dword [ebp - 0x960], 0
mov dword [ebp - 0x95c], 0xf
call fcn.100af0c0
movups xmm0, xmmword [str.NotepadPlusPlus.exe]
mov ecx, eax
mov dword [ebp - 0x960], 0x13
mov dword [ebp - 0x970], ecx
mov dword [ebp - 0x95c], 0x1f
movups xmmword [ecx], xmm0
movzx eax, word [0x1010d434]
mov word [ecx + 0x10], ax
movzx eax, byte [0x1010d436]
mov byte [ecx + 0x12], al
mov byte [ecx + 0x13], 0
movzx eax, byte [0x1010d440]
xorps xmm0, xmm0
movups xmmword [ebp - 0x958], xmm0
mov dword [ebp - 0x948], 9
movq xmm0, qword [str.Fraps.exe]
mov dword [ebp - 0x944], 0xf
movq qword [ebp - 0x958], xmm0
mov byte [ebp - 0x950], al
mov byte [ebp - 0x94f], 0
mov eax, dword [0x1010d44c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x940], xmm0
mov dword [ebp - 0x930], 0xc
movq xmm0, qword [str.CCleaner.exe]
mov dword [ebp - 0x92c], 0xf
movq qword [ebp - 0x940], xmm0
mov dword [ebp - 0x938], eax
mov byte [ebp - 0x934], 0
mov eax, dword [str.Git.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x928], xmm0
mov dword [ebp - 0x928], eax
movzx eax, word [0x1010d458]
mov word [ebp - 0x924], ax
movzx eax, byte [0x1010d45a]
mov dword [ebp - 0x918], 7
mov dword [ebp - 0x914], 0xf
mov byte [ebp - 0x922], al
mov byte [ebp - 0x921], 0
movzx eax, word [0x1010d464]
movups xmmword [ebp - 0x910], xmm0
mov dword [ebp - 0x900], 0xa
movq xmm0, qword [str.3dsMax.exe]
mov dword [ebp - 0x8fc], 0xf
movq qword [ebp - 0x910], xmm0
mov word [ebp - 0x908], ax
mov byte [ebp - 0x906], 0
mov byte [ebp - 4], 7
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0x8f8], xmm0
mov dword [ebp - 0x8e8], 0
mov dword [ebp - 0x8e4], 0xf
call fcn.100af0c0
movups xmm0, xmmword [str.UnrealEngine.exe]
mov dword [ebp - 0x8f8], eax
mov dword [ebp - 0x8e8], 0x10
mov dword [ebp - 0x8e4], 0x1f
movups xmmword [eax], xmm0
mov byte [eax + 0x10], 0
mov eax, dword [0x1010d484]
xorps xmm0, xmm0
movups xmmword [ebp - 0x8e0], xmm0
mov dword [ebp - 0x8d8], eax
movq xmm0, qword [str.OBSStudio.exe]
movzx eax, byte [0x1010d488]
mov dword [ebp - 0x8d0], 0xd
mov dword [ebp - 0x8cc], 0xf
movq qword [ebp - 0x8e0], xmm0
mov byte [ebp - 0x8d4], al
mov byte [ebp - 0x8d3], 0
mov eax, dword [0x1010d494]
xorps xmm0, xmm0
movups xmmword [ebp - 0x8c8], xmm0
mov dword [ebp - 0x8b8], 0xc
movq xmm0, qword [str.Audacity.exe]
mov dword [ebp - 0x8b4], 0xf
movq qword [ebp - 0x8c8], xmm0
mov dword [ebp - 0x8c0], eax
mov byte [ebp - 0x8bc], 0
mov byte [ebp - 4], 0xa
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0x8b0], xmm0
mov dword [ebp - 0x8a0], 0
mov dword [ebp - 0x89c], 0xf
call fcn.100af0c0
movups xmm0, xmmword [str.AcrobatReader.exe]
mov ecx, eax
mov dword [ebp - 0x8a0], 0x11
mov dword [ebp - 0x8b0], ecx
mov dword [ebp - 0x89c], 0x1f
movups xmmword [ecx], xmm0
movzx eax, byte [0x1010d4ac]
mov byte [ecx + 0x10], al
mov byte [ecx + 0x11], 0
movzx eax, word [0x1010d4b8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x898], xmm0
mov word [ebp - 0x890], ax
movq xmm0, qword [str.Dropbox.exe]
movzx eax, byte [0x1010d4ba]
mov dword [ebp - 0x888], 0xb
mov dword [ebp - 0x884], 0xf
movq qword [ebp - 0x898], xmm0
mov byte [ebp - 0x88e], al
mov byte [ebp - 0x88d], 0
xorps xmm0, xmm0
mov dword [ebp - 0x870], 0xa
movups xmmword [ebp - 0x880], xmm0
mov dword [ebp - 0x86c], 0xf
movq xmm0, qword [str.VSCode.exe]
movzx eax, word [0x1010d4c4]
movq qword [ebp - 0x880], xmm0
mov word [ebp - 0x878], ax
mov byte [ebp - 0x876], 0
movzx eax, byte [0x1010d4d0]
xorps xmm0, xmm0
movups xmmword [ebp - 0x868], xmm0
mov dword [ebp - 0x858], 9
movq xmm0, qword [str.PuTTY.exe]
mov dword [ebp - 0x854], 0xf
movq qword [ebp - 0x868], xmm0
mov byte [ebp - 0x860], al
mov byte [ebp - 0x85f], 0
movzx eax, word [0x1010d4dc]
xorps xmm0, xmm0
movups xmmword [ebp - 0x850], xmm0
mov dword [ebp - 0x840], 0xa
movq xmm0, qword [str.WinSCP.exe]
mov dword [ebp - 0x83c], 0xf
movq qword [ebp - 0x850], xmm0
mov word [ebp - 0x848], ax
mov byte [ebp - 0x846], 0
mov eax, dword [0x1010d4e8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x838], xmm0
mov dword [ebp - 0x830], eax
movq xmm0, qword [str.VirtualBox.exe]
movzx eax, word [0x1010d4ec]
mov dword [ebp - 0x828], 0xe
mov dword [ebp - 0x824], 0xf
movq qword [ebp - 0x838], xmm0
mov word [ebp - 0x82c], ax
mov byte [ebp - 0x82a], 0
movzx eax, word [0x1010d4f8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x820], xmm0
mov dword [ebp - 0x810], 0xa
movq xmm0, qword [str.Origin.exe]
mov dword [ebp - 0x80c], 0xf
movq qword [ebp - 0x820], xmm0
mov word [ebp - 0x818], ax
mov byte [ebp - 0x816], 0
xorps xmm0, xmm0
mov dword [ebp - 0x7f8], 8
movups xmmword [ebp - 0x808], xmm0
mov dword [ebp - 0x7f4], 0xf
mov dword [ebp - 0x808], 0x65646f4e
mov dword [ebp - 0x804], 0x6578652e
mov byte [ebp - 0x800], 0
movups xmmword [ebp - 0x7f0], xmm0
mov dword [ebp - 0x7e0], 8
mov dword [ebp - 0x7dc], 0xf
mov dword [ebp - 0x7f0], 0x504d4947
mov dword [ebp - 0x7ec], 0x6578652e
mov byte [ebp - 0x7e8], 0
mov eax, dword [0x1010d504]
movups xmmword [ebp - 0x7d8], xmm0
mov dword [ebp - 0x7c8], 0xc
movq xmm0, qword [str.Inkscape.exe]
mov dword [ebp - 0x7c4], 0xf
movq qword [ebp - 0x7d8], xmm0
mov dword [ebp - 0x7d0], eax
mov byte [ebp - 0x7cc], 0
xorps xmm0, xmm0
mov dword [ebp - 0x7b0], 8
movups xmmword [ebp - 0x7c0], xmm0
mov dword [ebp - 0x7ac], 0xf
mov dword [ebp - 0x7c0], 0x6176614a
mov dword [ebp - 0x7bc], 0x6578652e
mov byte [ebp - 0x7b8], 0
mov byte [ebp - 4], 0x15
movups xmmword [ebp - 0x7a8], xmm0
push 0x20
mov dword [ebp - 0x798], 0
mov dword [ebp - 0x794], 0xf
call fcn.100af0c0
movups xmm0, xmmword [str.Malwarebytes.exe]
mov dword [ebp - 0x7a8], eax
mov dword [ebp - 0x798], 0x10
mov dword [ebp - 0x794], 0x1f
movups xmmword [eax], xmm0
mov byte [eax + 0x10], 0
mov eax, dword [0x1010d528]
xorps xmm0, xmm0
movups xmmword [ebp - 0x790], xmm0
mov dword [ebp - 0x788], eax
movq xmm0, qword [str.PostgreSQL.exe]
movzx eax, word [0x1010d52c]
mov dword [ebp - 0x780], 0xe
mov dword [ebp - 0x77c], 0xf
movq qword [ebp - 0x790], xmm0
mov word [ebp - 0x784], ax
mov byte [ebp - 0x782], 0
mov eax, dword [0x1010d538]
xorps xmm0, xmm0
movups xmmword [ebp - 0x778], xmm0
mov dword [ebp - 0x770], eax
movq xmm0, qword [str.PowerPoint.exe]
movzx eax, word [0x1010d53c]
mov dword [ebp - 0x768], 0xe
mov dword [ebp - 0x764], 0xf
movq qword [ebp - 0x778], xmm0
mov word [ebp - 0x76c], ax
mov byte [ebp - 0x76a], 0
mov eax, dword [str.SVN.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x760], xmm0
mov dword [ebp - 0x760], eax
movzx eax, word [0x1010d544]
mov word [ebp - 0x75c], ax
movzx eax, byte [0x1010d546]
mov dword [ebp - 0x750], 7
mov dword [ebp - 0x74c], 0xf
mov byte [ebp - 0x75a], al
mov byte [ebp - 0x759], 0
mov eax, dword [str.PHP.exe]
movups xmmword [ebp - 0x748], xmm0
mov dword [ebp - 0x748], eax
movzx eax, word [0x1010d54c]
mov word [ebp - 0x744], ax
movzx eax, byte [0x1010d54e]
mov dword [ebp - 0x738], 7
mov dword [ebp - 0x734], 0xf
mov byte [ebp - 0x742], al
mov byte [ebp - 0x741], 0
movups xmmword [ebp - 0x730], xmm0
mov dword [ebp - 0x720], 8
mov dword [ebp - 0x71c], 0xf
mov dword [ebp - 0x730], 0x6d6f6f5a
mov dword [ebp - 0x72c], 0x6578652e
mov byte [ebp - 0x728], 0
movzx eax, word [0x1010d558]
movups xmmword [ebp - 0x718], xmm0
mov word [ebp - 0x710], ax
movq xmm0, qword [str.AutoCAD.exe]
movzx eax, byte [0x1010d55a]
mov dword [ebp - 0x708], 0xb
mov dword [ebp - 0x704], 0xf
movq qword [ebp - 0x718], xmm0
mov byte [ebp - 0x70e], al
mov byte [ebp - 0x70d], 0
mov byte [ebp - 4], 0x1c
xorps xmm0, xmm0
movups xmmword [ebp - 0x700], xmm0
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x6ec], 0xf
push 0x20
call fcn.100af0c0
movups xmm0, xmmword [str.QuickTimePlayer.exe]
mov ecx, eax
mov dword [ebp - 0x6f0], 0x13
mov dword [ebp - 0x700], ecx
add esp, 0x14
mov dword [ebp - 0x6ec], 0x1f
movups xmmword [ecx], xmm0
movzx eax, word [0x1010d56c]
mov word [ecx + 0x10], ax
movzx eax, byte [0x1010d56e]
mov byte [ecx + 0x12], al
mov byte [ecx + 0x13], 0
movzx eax, byte [0x1010d578]
xorps xmm0, xmm0
movups xmmword [ebp - 0x6e8], xmm0
mov dword [ebp - 0x6d8], 9
movq xmm0, qword [str.Paint.exe]
mov dword [ebp - 0x6d4], 0xf
movq qword [ebp - 0x6e8], xmm0
mov byte [ebp - 0x6e0], al
mov byte [ebp - 0x6df], 0
mov eax, dword [0x1010d584]
xorps xmm0, xmm0
movups xmmword [ebp - 0x6d0], xmm0
mov dword [ebp - 0x6c8], eax
movq xmm0, qword [str.Calculator.exe]
movzx eax, word [0x1010d588]
mov dword [ebp - 0x6c0], 0xe
mov dword [ebp - 0x6bc], 0xf
movq qword [ebp - 0x6d0], xmm0
mov word [ebp - 0x6c4], ax
mov byte [ebp - 0x6c2], 0
mov eax, dword [0x1010d594]
xorps xmm0, xmm0
movups xmmword [ebp - 0x6b8], xmm0
mov dword [ebp - 0x6b0], eax
movq xmm0, qword [str.FileZilla.exe]
movzx eax, byte [0x1010d598]
mov dword [ebp - 0x6a8], 0xd
mov dword [ebp - 0x6a4], 0xf
movq qword [ebp - 0x6b8], xmm0
mov byte [ebp - 0x6ac], al
mov byte [ebp - 0x6ab], 0
movzx eax, byte [0x1010d5a4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x6a0], xmm0
mov dword [ebp - 0x690], 9
movq xmm0, qword [str.Uplay.exe]
mov dword [ebp - 0x68c], 0xf
movq qword [ebp - 0x6a0], xmm0
mov byte [ebp - 0x698], al
mov byte [ebp - 0x697], 0
xorps xmm0, xmm0
mov dword [ebp - 0x678], 8
movups xmmword [ebp - 0x688], xmm0
mov dword [ebp - 0x674], 0xf
mov dword [ebp - 0x688], 0x79627552
mov dword [ebp - 0x684], 0x6578652e
mov byte [ebp - 0x680], 0
movzx eax, word [0x1010d5b0]
movups xmmword [ebp - 0x670], xmm0
mov word [ebp - 0x668], ax
movq xmm0, qword [str.Notepad.exe]
movzx eax, byte [0x1010d5b2]
mov dword [ebp - 0x660], 0xb
mov dword [ebp - 0x65c], 0xf
movq qword [ebp - 0x670], xmm0
mov byte [ebp - 0x666], al
mov byte [ebp - 0x665], 0
xorps xmm0, xmm0
mov dword [ebp - 0x648], 0xb
movups xmmword [ebp - 0x658], xmm0
movzx eax, word [0x1010d5bc]
movq xmm0, qword [str.Blender.exe]
mov word [ebp - 0x650], ax
movzx eax, byte [0x1010d5be]
mov dword [ebp - 0x644], 0xf
movq qword [ebp - 0x658], xmm0
mov byte [ebp - 0x64e], al
mov byte [ebp - 0x64d], 0
xorps xmm0, xmm0
mov dword [ebp - 0x630], 8
movups xmmword [ebp - 0x640], xmm0
mov dword [ebp - 0x62c], 0xf
mov dword [ebp - 0x640], 0x6179614d
mov dword [ebp - 0x63c], 0x6578652e
mov byte [ebp - 0x638], 0
movzx eax, byte [0x1010d5c8]
movups xmmword [ebp - 0x628], xmm0
mov dword [ebp - 0x618], 9
movq xmm0, qword [str.Teams.exe]
mov dword [ebp - 0x614], 0xf
movq qword [ebp - 0x628], xmm0
mov byte [ebp - 0x620], al
mov byte [ebp - 0x61f], 0
mov eax, dword [0x1010d5d4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x610], xmm0
mov dword [ebp - 0x608], eax
movzx eax, word [0x1010d5d8]
movq xmm0, qword [str.TortoiseSVN.exe]
mov word [ebp - 0x604], ax
movzx eax, byte [0x1010d5da]
mov dword [ebp - 0x600], 0xf
mov dword [ebp - 0x5fc], 0xf
movq qword [ebp - 0x610], xmm0
mov byte [ebp - 0x602], al
mov byte [ebp - 0x601], 0
movzx eax, word [0x1010d5e4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x5f8], xmm0
mov word [ebp - 0x5f0], ax
movq xmm0, qword [str.NetEase.exe]
movzx eax, byte [0x1010d5e6]
mov dword [ebp - 0x5e8], 0xb
mov dword [ebp - 0x5e4], 0xf
movq qword [ebp - 0x5f8], xmm0
mov byte [ebp - 0x5ee], al
mov byte [ebp - 0x5ed], 0
push str.Mangoo.exe
lea ecx, [ebp - 0x5e0]
mov byte [ebp - 4], 0x28
call fcn.10004b00
push str.Bitdefender.exe
lea ecx, [ebp - 0x5c8]
mov byte [ebp - 4], 0x29
call fcn.10004b00
push str.AdobePremierePro.exe
lea ecx, [ebp - 0x5b0]
mov byte [ebp - 4], 0x2a
call fcn.10004b00
push str.FinalCutPro.exe
lea ecx, [ebp - 0x598]
mov byte [ebp - 4], 0x2b
call fcn.10004b00
push str.Lightroom.exe
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x2c
call fcn.10004b00
push str.Word.exe
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0x2d
call fcn.10004b00
push str.Sina.exe
lea ecx, [ebp - 0x550]
mov byte [ebp - 4], 0x2e
call fcn.10004b00
push str.Winamp.exe
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 0x2f
call fcn.10004b00
push str.OneDrive.exe
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0x30
call fcn.10004b00
push str.Outlook.exe
lea ecx, [ebp - 0x508]
mov byte [ebp - 4], 0x31
call fcn.10004b00
push str.xunfei.exe
lea ecx, [ebp - 0x4f0]
mov byte [ebp - 4], 0x32
call fcn.10004b00
push str.VMware.exe
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x33
call fcn.10004b00
push str.CMD.exe
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 0x34
call fcn.10004b00
push str.SQLServer.exe
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0x35
call fcn.10004b00
push str.Camtasia.exe
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 0x36
call fcn.10004b00
push str.Skype.exe
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 0x37
call fcn.10004b00
push str.DaVinciResolve.exe
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0x38
call fcn.10004b00
push str.Cinebench.exe
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 0x39
call fcn.10004b00
push str.DiskDefrag.exe
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 0x3a
call fcn.10004b00
push str.Apache.exe
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 0x3b
call fcn.10004b00
push str.Perl.exe
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x3c
call fcn.10004b00
push str.WangWang.exe
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 0x3d
call fcn.10004b00
push str.Google.exe
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x3e
call fcn.10004b00
push str.Firefox.exe
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0x3f
call fcn.10004b00
push str.FLStudio.exe
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 0x40
call fcn.10004b00
push str.Avast.exe
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 0x41
call fcn.10004b00
push str.WhatsApp.exe
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x42
call fcn.10004b00
push str.Spotify.exe
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x43
call fcn.10004b00
push str.iTunes.exe
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0x44
call fcn.10004b00
push str.XAMPP.exe
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x45
call fcn.10004b00
push str.WAMP.exe
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0x46
call fcn.10004b00
push str.PyCharm.exe
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x47
call fcn.10004b00
push str.VisualStudio.exe
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x48
call fcn.10004b00
push str.Python.exe
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0x49
call fcn.10004b00
push str.XSplit.exe
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x4a
call fcn.10004b00
push str.McAfee.exe
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x4b
call fcn.10004b00
push str.Norton.exe
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x4c
call fcn.10004b00
push str.EpicGamesLauncher.exe
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x4d
call fcn.10004b00
mov byte [ebp - 4], 0x4e
push str.BattleNet.exe
lea ecx, [ebp - 0x250]
call fcn.10004b00
push str.HWMonitor.exe
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x4f
call fcn.10004b00
push str.Eclipse.exe
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x50
call fcn.10004b00
push str.IntelliJIDEA.exe
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x51
call fcn.10004b00
push str.AfterEffects.exe
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x52
call fcn.10004b00
push str.MongoDB.exe
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x53
call fcn.10004b00
push str.Speccy.exe
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0x54
call fcn.10004b00
push str.SysInternals.exe
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x55
call fcn.10004b00
push str.TaskManager.exe
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x56
call fcn.10004b00
push str.PowerShell.exe
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x57
call fcn.10004b00
push str.SolidWorks.exe
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x58
call fcn.10004b00
push str.TeamViewer.exe
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0x59
call fcn.10004b00
push str.VLC.exe
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x5a
call fcn.10004b00
push str.GPUZ.exe
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x5b
call fcn.10004b00
push str.MySQL.exe
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x5c
call fcn.10004b00
push str.CPUZ.exe
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x5d
call fcn.10004b00
mov byte [ebp - 4], 0x5e
push str.Photoshop.exe
lea ecx, [ebp - 0xd0]
call fcn.10004b00
push str.Illustrator.exe
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x5f
call fcn.10004b00
push str.AnyDesk.exe
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x60
call fcn.10004b00
push str.weChat.exe
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x61
call fcn.10004b00
push str.Slack.exe
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x62
call fcn.10004b00
push str.Kaspersky.exe
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x63
call fcn.10004b00
push str.IIS.exe
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x64
call fcn.10004b00
push str.Regedit.exe
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x65
call fcn.10004b00
lea ecx, [ebp - 0x9b8]
mov dword [ebp - 4], 0x66
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
lea ecx, [ebp - 0x9c8]
call fcn.10027f70
push fcn.10004a60
push 0x67
push 0x18
lea eax, [ebp - 0x9b8]
mov byte [ebp - 4], 0x68
push eax
call fcn.100af1db
push 0
call fcn.100c5467
push eax
call fcn.100c5455
add esp, 8
lea ecx, [ebp - 0x9c8]
call fcn.10027f50
mov esi, eax
call fcn.100c5434
xor edx, edx
lea ecx, [ebp - 0x9c8]
div esi
push edx
call fcn.10027f30
push eax
mov ecx, edi
call fcn.10004b40
lea ecx, [ebp - 0x9c8]
call fcn.100138f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100af09a
mov esp, ebp
pop ebp
ret