Function at 0x100315fc
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
sub esp, 0x808
mov eax, dword [0x10084adc]
xor eax, esp
mov dword [esp + 0x804], eax
call fcn.10031231
test al, al
jne 0x10031620
xor eax, eax
jmp 0x1003241a
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebp
push 0x3ff
mov dword [0x101580cc], eax
xor edi, edi
lea eax, [esp + 0x19]
push edi
push eax
mov byte [0x10155828], 0
mov byte [esp + 0x20], 0
call fcn.10045030
add esp, 0xc
test dword [0x101580d8], 0xc0000000
je 0x100316ff
push edi
push str.tc_MENU_EXP_Time
mov ebx, str.SOFTWARETrojanCut_tc_Env
push ebx
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.10040ccf
push edi
push str.tc_MENU_EXP_ID
push ebx
push esi
mov dword [0x10151844], eax
call fcn.10040ccf
add esp, 0x20
push 0xa
cdq
pop ecx
idiv ecx
mov dword [0x10151848], eax
call ebp
cmp eax, dword [0x10151844]
jae 0x100316ff
mov eax, dword [0x10151848]
cmp eax, dword [0x10185a54]
je 0x100316d0
cmp eax, dword [0x10185a58]
je 0x100316d0
cmp eax, dword [0x10185a5c]
je 0x100316d0
cmp eax, dword [0x10185a60]
je 0x100316d0
cmp eax, dword [0x10185a64]
jne 0x100316ff
mov byte [0x10078497], 0
cmp dword [0x1015668c], edi
je 0x100316ec
push str.Ransom_Protect_Except
push edi
call fcn.100412e2
pop ecx
pop ecx
test dword [0x101580d8], 0x40000000
je 0x100316ff
xor eax, eax
jmp 0x10032416
cmp byte [0x10154168], 0
mov esi, 0x10154168
mov ebx, 0x20000
je 0x10031801
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003171b
sub eax, edx
cmp eax, 3
jbe 0x10031801
cmp dword [0x1015668c], edi
je 0x10031749
push esi
push 0x10155228
push str.MyGetFileVersionInformation___s__s_
push edi
call fcn.100412e2
add esp, 0x10
push esi
lea eax, [esp + 0x18]
push 0x1006d2c0
push eax
call fcn.10045378
lea eax, [esp + 0x20]
push eax
call fcn.10045308
lea eax, [esp + 0x24]
push eax
push str.fb_messengermicrosoft_lyncmicrosoft_lync_2010skype_for_businessi_messenger_uclantalk.net_messengerbigant_messengercoolmessengerdaum
call fcn.10045450
add esp, 0x18
test eax, eax
je 0x1003177f
mov dword [0x102b5a34], ebx
lea eax, [esp + 0x14]
push str.coolmessenger
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100317a4
mov dword [0x102b5a34], ebx
mov dword [0x102b5a38], 0x40
lea eax, [esp + 0x14]
push eax
push str.nateon_messenger
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100317c3
mov dword [0x102b5a38], 2
lea eax, [esp + 0x14]
push eax
push 0x1006d05c
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100317e2
mov dword [0x102b5a38], 4
lea eax, [esp + 0x14]
push eax
push str.skype_for_business
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031801
mov dword [0x102b5a38], 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov dword [esp + 0x14], eax
call fcn.10045308
call fcn.10031513
mov ebp, 0x10155628
mov dword [esp], 0x1006d03c
push ebp
call fcn.10007795
pop ecx
pop ecx
mov ebx, 0x10155428
test eax, eax
jne 0x10031842
mov dword [0x102b5a3c], 1
jmp 0x10031989
push str.teamviewer_service.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031862
mov dword [0x102b5a3c], 2
jmp 0x10031989
push str.tv_w32.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031882
mov dword [0x102b5a3c], 3
jmp 0x10031989
push str.evernote.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100318a2
mov dword [0x102b5a3c], 4
jmp 0x10031989
push str.svchost.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
mov esi, str._system32_
mov edi, str._syswow64_
test eax, eax
jne 0x100318e6
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100318d7
push edi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100318e6
mov dword [0x102b5a3c], 5
jmp 0x10031989
push str.dllhost.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003191d
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10031911
push edi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1003191d
mov dword [0x102b5a3c], 6
jmp 0x10031989
push str.rundll32.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031954
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10031948
push edi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031954
mov dword [0x102b5a3c], 7
jmp 0x10031989
push str.services.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031989
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1003197f
push edi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031989
mov dword [0x102b5a3c], 8
push 0x1006cfbc
push ebp
call fcn.10007795
pop ecx
pop ecx
push 0x10
pop edi
mov esi, 0x1006cfb4
test eax, eax
jne 0x100319af
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100319cd
push 0x1006cfa4
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100319de
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100319de
mov dword [0x101580b8], edi
mov dword [0x101580c4], edi
jmp 0x10031cf8
push str.ddxbot.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100319fb
mov byte [0x101580b3], 1
jmp 0x10031cf8
push 0x1006cf8c
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031a1b
mov dword [0x101580b8], 0x60
jmp 0x10031cf8
push str.excel.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
mov edi, str.microsoft_office
test eax, eax
jne 0x10031a45
push edi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031a45
push 2
jmp 0x10031b9c
push str.groove.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031a65
mov dword [0x101580b8], 0x80
jmp 0x10031cf8
push str.hwp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031a8e
push 0x1006cf50
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031a8e
push 8
jmp 0x10031b9c
push 0x1006cf44
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031abf
push 0x1006cf38
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031abf
mov dword [0x101580a8], 3
jmp 0x10031ceb
push str.msosync.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031adf
mov dword [0x101580b8], 0x200
jmp 0x10031cf8
push str.mssq.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031c0f
push str.onenote.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031b19
mov eax, 0x100
mov dword [0x101580b8], eax
mov dword [0x101580bc], eax
jmp 0x10031cf8
push 0x1006cf08
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031b7c
push 0x1006cf00
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031b7c
xor eax, eax
inc eax
mov dword [0x100a2bf8], eax
mov dword [0x101580a8], eax
mov dword [0x101adacc], eax
call fcn.1002c845
cmp dword [0x1015668c], 0
mov byte [0x1014fdb8], al
je 0x10031cf8
movzx eax, al
push eax
push str.IsExchange___d_
push 0
call fcn.100412e2
add esp, 0xc
jmp 0x10031cf8
push str.powerpnt.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031ba2
push edi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031ba2
push 4
pop eax
jmp 0x10031c8d
push str.spoolsv
push ebp
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031bbf
mov byte [0x101580b0], 1
jmp 0x10031cf8
push str.sqlwriter.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
mov esi, 0x1006ceb8
test eax, eax
jne 0x10031bf1
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031bf1
mov dword [0x101580b4], 0x20
jmp 0x10031cf8
push 0x1006cea8
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031c1e
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031c1e
mov dword [0x101580b8], 0x20
jmp 0x10031cf8
push 0x1006ce9c
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031c3e
mov dword [0x101580b8], 0x400
jmp 0x10031cf8
push str.vmplayer.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031c6c
push str._vmware_workstation
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031c6c
mov byte [0x101580d2], 1
jmp 0x10031cf8
push str.winword.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031c99
push edi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031c99
xor eax, eax
inc eax
mov dword [0x101580b8], eax
mov dword [0x101580c4], eax
jmp 0x10031cf8
push str.wlcomm.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031cbf
cmp dword [0x10078cd8], 0x501
jle 0x10031cbf
mov byte [0x101580d3], 1
jmp 0x10031cf8
push 0x1006ce54
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031cf8
push 0x1006ce48
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031cf8
mov dword [0x101580a8], 2
xor eax, eax
inc eax
mov dword [0x101adacc], eax
mov dword [0x100a2bf8], eax
push 0x1006b5f0
push ebp
call fcn.10007795
pop ecx
pop ecx
mov edi, 0x10156e68
test eax, eax
jne 0x10031d37
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031d13
sub eax, esi
push eax
push ebx
push edi
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x10031d37
mov byte [0x101580d0], 1
jmp 0x10031eb3
push str.powershell.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
mov esi, str.windowspowershell
test eax, eax
jne 0x10031d5a
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10031d2b
push str.powershell_ise.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031d78
push esi
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10031d2b
push 0x1006ce04
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031d2b
push str.browserpluscore.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031da6
mov byte [0x101580d1], 1
jmp 0x10031eb3
push str.browserplusservice.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031d9a
push 0x1006cdcc
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031dd7
mov dword [0x102b5a34], 0x400
jmp 0x10031eb3
push str.xcopy.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031df4
mov byte [0x101580b2], 1
jmp 0x10031eb3
push str.filezilla.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031dc8
push str.filezilla_server.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031dc8
push str.daftp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031dc8
push str.winscp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031dc8
push str.flashfxp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031dc8
push str.ftp.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031dc8
push ebp
push str.fbmessenger.execommunicator.exelync.exeimessengeruc.exeline.exekakaotalk.exewlcomm.exeucware_m.exenavertalk.exenavert1.exemypeople.execoolmessenger.execoolme1.exenateonmain.exenateon1.exedame40.exemsnmsgr.exeyahoomessenger.exeyahoom1.exegoogletalk.exegoogle1.exeu2messenger.exeu2mess1.exeunimsg.exe_messenger.exekuki.exetachy.exeonmate.exemissleemessenger.exemissle1.exeactivepostgsuite.exeactive1.exebigant.exebuddybuddy.exeicq.exemiranda32.exemirand1.exelantalk.exemessenger.exemessen1.exeskypeapp.exeskype.exeneobizbox.exeneobiz1.exetelegram.exeteams.exeWhatsapp.exewechat.exeviber.exeqq.exe
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031eb3
push 0x1006cac4
push ebp
mov dword [0x102b5a34], 0x20000
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031e98
mov dword [0x100a2bdc], 3
push str.u2messenger.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031eb3
mov dword [0x100a2bdc], 2
push 0x10155a28
push 0x10156428
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10031ed6
mov dword [0x102b5a34], 0x20000
jmp 0x10031f6a
push str.ezbuilder.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10031ef8
push str.ezbuil1.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031f04
mov dword [0x10185648], 0x12378923
jmp 0x10031f6a
push 0x1006ca88
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031f26
push 0x1006ca7c
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10031f59
push 0x1006ca70
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10031f59
push 0x1006ca60
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031f6a
push 0x1006ca58
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10031f6a
mov byte [0x100784b2], 0
mov dword [0x10151cc0], 1
push 0x1006ca50
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031f8c
push 0x1006ca48
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10031fbf
push 0x1006ca3c
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031fae
push 0x1006ca34
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10031fbf
push 0x1006ca28
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10031fd5
mov byte [0x100784b2], 0
mov dword [0x10151cc0], 1
jmp 0x100320b9
push 0x1006ca1c
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10032006
push str.itunes_
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10032006
mov dword [0x10151cc0], 2
jmp 0x100320b9
push 0x1006c864
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003204d
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003201c
sub eax, esi
push eax
push ebx
push edi
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x1003204d
mov esi, str.Metro
mov edi, 0x10155c28
movsd dword es:[edi], dword [esi]
mov dword [0x101580c0], 0x100
movsw word es:[edi], word [esi]
jmp 0x100320b9
push str.telegram.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003206a
mov dword [0x102b5a38], 0x10
jmp 0x100320b9
cmp dword [0x102b5a38], 0
jne 0x10032090
push ebp
push str.fbmessenger.execommunicator.exelync.exeimessengeruc.exeline.exekakaotalk.exewlcomm.exeucware_m.exenavertalk.exenavert1.exemypeople.execoolmessenger.execoolme1.exenateonmain.exenateon1.exedame40.exemsnmsgr.exeyahoomessenger.exeyahoom1.exegoogletalk.exegoogle1.exeu2messenger.exeu2mess1.exeunimsg.exe_messenger.exekuki.exetachy.exeonmate.exemissleemessenger.exemissle1.exeactivepostgsuite.exeactive1.exebigant.exebuddybuddy.exeicq.exemiranda32.exemirand1.exelantalk.exemessenger.exemessen1.exeskypeapp.exeskype.exeneobizbox.exeneobiz1.exetelegram.exeteams.exeWhatsapp.exewechat.exeviber.exeqq.exe
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10032090
mov dword [0x102b5a38], 0xff000000
jmp 0x100320b9
push 0x10067ca0
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100320b9
push 0x10067b04
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100320b9
mov byte [0x101580e9], 1
mov esi, dword [esp + 0x10]
test esi, esi
je 0x100320e8
cmp byte [esi], 0
je 0x100320e8
push str.rundll32.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100320e8
push str.photoviewer.dll
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1003215b
push str.tempcr_
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1003215b
cmp byte [0x1014fdba], al
jne 0x1003215b
push str.geni_
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1003215b
push str.delfino_
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1003215b
push ebx
push ebp
push str.7z.exe
call fcn.1003158e
add esp, 0xc
test al, al
jne 0x1003215b
test dword [0x1015786c], 0x2000000
je 0x10032162
mov eax, dword [0x102b5a3c]
cmp eax, 5
je 0x1003215b
cmp eax, 8
je 0x1003215b
cmp eax, 7
je 0x1003215b
cmp eax, 6
jne 0x10032162
mov byte [0x10078497], 0
push str.C:Program_FilesCodeGearRAD_Studio.
call fcn.10040a77
test eax, eax
setne al
pop ecx
mov byte [0x1015162e], al
test al, al
jne 0x100321c2
push str.C:Program_Files__x86_CodeGearRAD_Studio.
call fcn.10040a77
test eax, eax
setne al
pop ecx
mov byte [0x1015162e], al
test al, al
jne 0x100321c2
push str.C:Program_FilesDelphi_bin.
call fcn.10040a77
test eax, eax
setne al
pop ecx
mov byte [0x1015162e], al
test al, al
jne 0x100321c2
push str.C:Program_Files__x86_Delphi_bin.
call fcn.10040a77
test eax, eax
setne al
pop ecx
mov byte [0x1015162e], al
test dword [0x102b5a34], 0x400
je 0x100321d5
mov byte [0x10078497], 0
push 0x1006a8fc
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003223b
push 0x1006a8f0
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003223b
push str.services.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003223b
push str.svchost.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003223b
push str.rundll32.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003223b
push str.dllhost.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10032298
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x3ff
mov esi, eax
lea eax, [esp + 0x419]
push 0
push eax
mov byte [esp + 0x420], 0
call fcn.10045030
push 0x10060ec9
push 0x100627f4
lea eax, [esp + 0x428]
push eax
push esi
call fcn.10040259
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x414]
mov byte [eax + 0x102b5630], cl
inc eax
test cl, cl
jne 0x1003227c
mov dword [0x1007849c], 0x54930a29
push str.nlockhook.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100322ae
mov byte [0x100784b3], 0
push str.msnmsgr.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x100322d0
push str.wlcomm.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100322d7
mov byte [0x101580e8], 1
push str.dame40.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100322fe
mov byte [0x101580e9], 1
mov dword [0x100a2bdc], 1
jmp 0x100323c0
push str.java.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10032320
push str.javaw.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10032330
mov byte [0x101580e9], 1
mov byte [0x101580ea], 1
jmp 0x10032341
push str.eclipse.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003234a
mov byte [0x1015496a], 1
jmp 0x100323c0
push str.mstsc.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003239f
push str.dsnetworkconnect.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003239f
push str.dsncservice.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003239f
push str.junipersetupclient.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1003239f
push str.f5fpclient_w.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100323a8
mov byte [0x101580e9], 1
jmp 0x100323c0
push 0x1006c878
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100323c0
mov byte [0x10152cd8], 1
cmp byte [0x10154168], 0
je 0x100323fb
mov esi, 0x10154168
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100323d3
sub eax, edx
cmp eax, 3
jbe 0x100323fb
push str.kakaotalk
push esi
call fcn.1004c839
pop ecx
pop ecx
test eax, eax
jne 0x100323fb
mov byte [0x10152cd8], 1
jmp 0x10032413
push str.ssh.exe
push ebp
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10032413
mov byte [0x101580e9], 1
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.1004501f
add esp, 0x808
ret