Function at 0x10031476
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
sub esp, 0x808
mov eax, dword [0x10083adc]
xor eax, esp
mov dword [esp + 0x804], eax
call fcn.100310ab
test al, al
jne 0x1003149a
xor eax, eax
jmp 0x10032294
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebp
push 0x3ff
mov dword [0x101570cc], eax
xor edi, edi
lea eax, [esp + 0x19]
push edi
push eax
mov byte [0x10154828], 0
mov byte [esp + 0x20], 0
call fcn.10044b80
add esp, 0xc
test dword [0x101570d8], 0xc0000000
je 0x10031579
push edi
push str.tc_MENU_EXP_Time
mov ebx, str.SOFTWARE_trueEP_tc_Env
push ebx
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.10040c17
push edi
push str.tc_MENU_EXP_ID
push ebx
push esi
mov dword [0x10150844], eax
call fcn.10040c17
add esp, 0x20
push 0xa
cdq
pop ecx
idiv ecx
mov dword [0x10150848], eax
call ebp
cmp eax, dword [0x10150844]
jae 0x10031579
mov eax, dword [0x10150848]
cmp eax, dword [0x10184a50]
je 0x1003154a
cmp eax, dword [0x10184a54]
je 0x1003154a
cmp eax, dword [0x10184a58]
je 0x1003154a
cmp eax, dword [0x10184a5c]
je 0x1003154a
cmp eax, dword [0x10184a60]
jne 0x10031579
mov byte [0x10077497], 0
cmp dword [0x1015568c], edi
je 0x10031566
push str.Ransom_Protect_Except
push edi
call fcn.1004122a
pop ecx
pop ecx
test dword [0x101570d8], 0x40000000
je 0x10031579
xor eax, eax
jmp 0x10032290
cmp byte [0x10153168], 0
mov esi, 0x10153168
mov ebx, 0x20000
je 0x1003167b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031595
sub eax, edx
cmp eax, 3
jbe 0x1003167b
cmp dword [0x1015568c], edi
je 0x100315c3
push esi
push 0x10154228
push str.MyGetFileVersionInformation___s__s_
push edi
call fcn.1004122a
add esp, 0x10
push esi
lea eax, [esp + 0x18]
push 0x1006d198
push eax
call fcn.10044ec8
lea eax, [esp + 0x20]
push eax
call fcn.10044e58
lea eax, [esp + 0x24]
push eax
push str.fb_messengermicrosoft_lyncmicrosoft_lync_2010skype_for_businessi_messenger_uclantalk.net_messengerbigant_messengercoolmessengerdaum
call fcn.10044fa0
add esp, 0x18
test eax, eax
je 0x100315f9
mov dword [0x102b4a34], ebx
lea eax, [esp + 0x14]
push str.coolmessenger
push eax
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1003161e
mov dword [0x102b4a34], ebx
mov dword [0x102b4a38], 0x40
lea eax, [esp + 0x14]
push eax
push str.nateon_messenger
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003163d
mov dword [0x102b4a38], 2
lea eax, [esp + 0x14]
push eax
push 0x1006cf34
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003165c
mov dword [0x102b4a38], 4
lea eax, [esp + 0x14]
push eax
push str.skype_for_business
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003167b
mov dword [0x102b4a38], 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov dword [esp + 0x14], eax
call fcn.10044e58
call fcn.1003138d
mov ebp, 0x10154628
mov dword [esp], 0x1006cf14
push ebp
call fcn.10007795
pop ecx
pop ecx
mov ebx, 0x10154428
test eax, eax
jne 0x100316bc
mov dword [0x102b4a3c], 1
jmp 0x10031803
push str.teamviewer_service.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100316dc
mov dword [0x102b4a3c], 2
jmp 0x10031803
push str.tv_w32.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100316fc
mov dword [0x102b4a3c], 3
jmp 0x10031803
push str.evernote.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003171c
mov dword [0x102b4a3c], 4
jmp 0x10031803
push str.svchost.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
mov esi, str._system32_
mov edi, str._syswow64_
test eax, eax
jne 0x10031760
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031751
push edi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031760
mov dword [0x102b4a3c], 5
jmp 0x10031803
push str.dllhost.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031797
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1003178b
push edi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031797
mov dword [0x102b4a3c], 6
jmp 0x10031803
push str.rundll32.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100317ce
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100317c2
push edi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x100317ce
mov dword [0x102b4a3c], 7
jmp 0x10031803
push str.services.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031803
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100317f9
push edi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031803
mov dword [0x102b4a3c], 8
push 0x1006ce94
push ebp
call fcn.10007795
pop ecx
pop ecx
push 0x10
pop edi
mov esi, 0x1006ce8c
test eax, eax
jne 0x10031829
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031847
push 0x1006ce7c
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031858
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031858
mov dword [0x101570b8], edi
mov dword [0x101570c4], edi
jmp 0x10031b72
push str.ddxbot.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031875
mov byte [0x101570b3], 1
jmp 0x10031b72
push 0x1006ce64
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031895
mov dword [0x101570b8], 0x60
jmp 0x10031b72
push str.excel.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
mov edi, str.microsoft_office
test eax, eax
jne 0x100318bf
push edi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x100318bf
push 2
jmp 0x10031a16
push str.groove.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100318df
mov dword [0x101570b8], 0x80
jmp 0x10031b72
push str.hwp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031908
push 0x1006ce28
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031908
push 8
jmp 0x10031a16
push 0x1006ce1c
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031939
push 0x1006ce10
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031939
mov dword [0x101570a8], 3
jmp 0x10031b65
push str.msosync.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031959
mov dword [0x101570b8], 0x200
jmp 0x10031b72
push str.mssq.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031a89
push str.onenote.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031993
mov eax, 0x100
mov dword [0x101570b8], eax
mov dword [0x101570bc], eax
jmp 0x10031b72
push 0x1006cde0
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100319f6
push 0x1006cdd8
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x100319f6
xor eax, eax
inc eax
mov dword [0x100a1bf8], eax
mov dword [0x101570a8], eax
mov dword [0x101acac4], eax
call fcn.1002c6c2
cmp dword [0x1015568c], 0
mov byte [0x1014edb8], al
je 0x10031b72
movzx eax, al
push eax
push str.IsExchange___d_
push 0
call fcn.1004122a
add esp, 0xc
jmp 0x10031b72
push str.powerpnt.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031a1c
push edi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031a1c
push 4
pop eax
jmp 0x10031b07
push str.spoolsv
push ebp
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031a39
mov byte [0x101570b0], 1
jmp 0x10031b72
push str.sqlwriter.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
mov esi, 0x1006cd90
test eax, eax
jne 0x10031a6b
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031a6b
mov dword [0x101570b4], 0x20
jmp 0x10031b72
push 0x1006cd80
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031a98
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031a98
mov dword [0x101570b8], 0x20
jmp 0x10031b72
push 0x1006cd74
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031ab8
mov dword [0x101570b8], 0x400
jmp 0x10031b72
push str.vmplayer.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031ae6
push str._vmware_workstation
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031ae6
mov byte [0x101570d2], 1
jmp 0x10031b72
push str.winword.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031b13
push edi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031b13
xor eax, eax
inc eax
mov dword [0x101570b8], eax
mov dword [0x101570c4], eax
jmp 0x10031b72
push str.wlcomm.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031b39
cmp dword [0x10077cd8], 0x501
jle 0x10031b39
mov byte [0x101570d3], 1
jmp 0x10031b72
push 0x1006cd2c
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031b72
push 0x1006cd20
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031b72
mov dword [0x101570a8], 2
xor eax, eax
inc eax
mov dword [0x101acac4], eax
mov dword [0x100a1bf8], eax
push 0x1006b4c4
push ebp
call fcn.10007795
pop ecx
pop ecx
mov edi, 0x10155e68
test eax, eax
jne 0x10031bb1
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031b8d
sub eax, esi
push eax
push ebx
push edi
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x10031bb1
mov byte [0x101570d0], 1
jmp 0x10031d2d
push str.powershell.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
mov esi, str.windowspowershell
test eax, eax
jne 0x10031bd4
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031ba5
push str.powershell_ise.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031bf2
push esi
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031ba5
push 0x1006ccdc
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031ba5
push str.browserpluscore.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031c20
mov byte [0x101570d1], 1
jmp 0x10031d2d
push str.browserplusservice.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031c14
push 0x1006cca4
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031c51
mov dword [0x102b4a34], 0x400
jmp 0x10031d2d
push str.xcopy.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031c6e
mov byte [0x101570b2], 1
jmp 0x10031d2d
push str.filezilla.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031c42
push str.filezilla_server.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031c42
push str.daftp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031c42
push str.winscp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031c42
push str.flashfxp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031c42
push str.ftp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031c42
push ebp
push str.fbmessenger.execommunicator.exelync.exeimessengeruc.exeline.exekakaotalk.exewlcomm.exeucware_m.exenavertalk.exenavert1.exemypeople.execoolmessenger.execoolme1.exenateonmain.exenateon1.exedame40.exemsnmsgr.exeyahoomessenger.exeyahoom1.exegoogletalk.exegoogle1.exeu2messenger.exeu2mess1.exeunimsg.exe_messenger.exekuki.exetachy.exeonmate.exemissleemessenger.exemissle1.exeactivepostgsuite.exeactive1.exebigant.exebuddybuddy.exeicq.exemiranda32.exemirand1.exelantalk.exemessenger.exemessen1.exeskypeapp.exeskype.exeneobizbox.exeneobiz1.exetelegram.exeteams.exeWhatsapp.exewechat.exeviber.exeqq.exe
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031d2d
push 0x1006c99c
push ebp
mov dword [0x102b4a34], 0x20000
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031d12
mov dword [0x100a1bdc], 3
push str.u2messenger.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031d2d
mov dword [0x100a1bdc], 2
push 0x10154a28
push 0x10155428
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10031d50
mov dword [0x102b4a34], 0x20000
jmp 0x10031de4
push str.ezbuilder.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031d72
push str.ezbuil1.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031d7e
mov dword [0x10180e44], 0x12378923
jmp 0x10031de4
push 0x1006c960
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031da0
push 0x1006c954
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031dd3
push 0x1006c948
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031dd3
push 0x1006c938
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031de4
push 0x1006c930
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031de4
mov byte [0x100774b2], 0
mov dword [0x10150cc0], 1
push 0x1006c928
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031e06
push 0x1006c920
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031e39
push 0x1006c914
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031e28
push 0x1006c90c
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031e39
push 0x1006c900
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031e4f
mov byte [0x100774b2], 0
mov dword [0x10150cc0], 1
jmp 0x10031f33
push 0x1006c8f4
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031e80
push str.itunes_
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031e80
mov dword [0x10150cc0], 2
jmp 0x10031f33
push 0x1006c73c
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031ec7
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031e96
sub eax, esi
push eax
push ebx
push edi
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x10031ec7
mov esi, str.Metro
mov edi, 0x10154c28
movsd dword es:[edi], dword [esi]
mov dword [0x101570c0], 0x100
movsw word es:[edi], word [esi]
jmp 0x10031f33
push str.telegram.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031ee4
mov dword [0x102b4a38], 0x10
jmp 0x10031f33
cmp dword [0x102b4a38], 0
jne 0x10031f0a
push ebp
push str.fbmessenger.execommunicator.exelync.exeimessengeruc.exeline.exekakaotalk.exewlcomm.exeucware_m.exenavertalk.exenavert1.exemypeople.execoolmessenger.execoolme1.exenateonmain.exenateon1.exedame40.exemsnmsgr.exeyahoomessenger.exeyahoom1.exegoogletalk.exegoogle1.exeu2messenger.exeu2mess1.exeunimsg.exe_messenger.exekuki.exetachy.exeonmate.exemissleemessenger.exemissle1.exeactivepostgsuite.exeactive1.exebigant.exebuddybuddy.exeicq.exemiranda32.exemirand1.exelantalk.exemessenger.exemessen1.exeskypeapp.exeskype.exeneobizbox.exeneobiz1.exetelegram.exeteams.exeWhatsapp.exewechat.exeviber.exeqq.exe
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031f0a
mov dword [0x102b4a38], 0xff000000
jmp 0x10031f33
push 0x10067b94
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031f33
push 0x100679f8
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10031f33
mov byte [0x101570e5], 1
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10031f62
cmp byte [esi], 0
je 0x10031f62
push str.rundll32.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031f62
push str.photoviewer.dll
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031fd5
push str.tempcr_
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031fd5
cmp byte [0x1014edba], al
jne 0x10031fd5
push str.geni_
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031fd5
push str.delfino_
push ebx
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10031fd5
push ebx
push ebp
push str.7z.exe
call fcn.10031408
add esp, 0xc
test al, al
jne 0x10031fd5
test dword [0x1015686c], 0x2000000
je 0x10031fdc
mov eax, dword [0x102b4a3c]
cmp eax, 5
je 0x10031fd5
cmp eax, 8
je 0x10031fd5
cmp eax, 7
je 0x10031fd5
cmp eax, 6
jne 0x10031fdc
mov byte [0x10077497], 0
push str.C:Program_FilesCodeGearRAD_Studio.
call fcn.100409bf
test eax, eax
setne al
pop ecx
mov byte [0x1015062e], al
test al, al
jne 0x1003203c
push str.C:Program_Files__x86_CodeGearRAD_Studio.
call fcn.100409bf
test eax, eax
setne al
pop ecx
mov byte [0x1015062e], al
test al, al
jne 0x1003203c
push str.C:Program_FilesDelphi_bin.
call fcn.100409bf
test eax, eax
setne al
pop ecx
mov byte [0x1015062e], al
test al, al
jne 0x1003203c
push str.C:Program_Files__x86_Delphi_bin.
call fcn.100409bf
test eax, eax
setne al
pop ecx
mov byte [0x1015062e], al
test dword [0x102b4a34], 0x400
je 0x1003204f
mov byte [0x10077497], 0
push 0x1006a7dc
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x100320b5
push 0x1006a7d0
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x100320b5
push str.services.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x100320b5
push str.svchost.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x100320b5
push str.rundll32.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x100320b5
push str.dllhost.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10032112
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x3ff
mov esi, eax
lea eax, [esp + 0x419]
push 0
push eax
mov byte [esp + 0x420], 0
call fcn.10044b80
push 0x10060ec9
push 0x100627e4
lea eax, [esp + 0x428]
push eax
push esi
call fcn.100401a1
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x414]
mov byte [eax + 0x102b4630], cl
inc eax
test cl, cl
jne 0x100320f6
mov dword [0x1007749c], 0x54930a29
push str.nlockhook.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10032128
mov byte [0x100774b3], 0
push str.msnmsgr.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003214a
push str.wlcomm.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10032151
mov byte [0x101570e4], 1
push str.dame40.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10032178
mov byte [0x101570e5], 1
mov dword [0x100a1bdc], 1
jmp 0x1003223a
push str.java.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003219a
push str.javaw.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100321aa
mov byte [0x101570e5], 1
mov byte [0x101570e6], 1
jmp 0x100321bb
push str.eclipse.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100321c4
mov byte [0x1015396a], 1
jmp 0x1003223a
push str.mstsc.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10032219
push str.dsnetworkconnect.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10032219
push str.dsncservice.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10032219
push str.junipersetupclient.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10032219
push str.f5fpclient_w.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10032222
mov byte [0x101570e5], 1
jmp 0x1003223a
push 0x1006c750
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003223a
mov byte [0x10151cd8], 1
cmp byte [0x10153168], 0
je 0x10032275
mov esi, 0x10153168
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003224d
sub eax, edx
cmp eax, 3
jbe 0x10032275
push str.kakaotalk
push esi
call fcn.1004c1f9
pop ecx
pop ecx
test eax, eax
jne 0x10032275
mov byte [0x10151cd8], 1
jmp 0x1003228d
push str.ssh.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003228d
mov byte [0x101570e5], 1
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.10044b6f
add esp, 0x808
ret