Function at 0x404930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c957f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x9c8
mov eax, dword [0x4f3480]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x9c4], edi
mov eax, dword [str.7z.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x9c0], xmm0
mov dword [ebp - 0x9c0], eax
movzx eax, word [0x4e7494]
mov dword [ebp - 0x9c4], edi
mov dword [ebp - 0x9b0], 6
mov dword [ebp - 0x9ac], 0xf
mov word [ebp - 0x9bc], ax
mov byte [ebp - 0x9ba], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4e74a0]
movups xmmword [ebp - 0x9a8], xmm0
mov dword [ebp - 0x998], 0xc
movq xmm0, qword [str.WhatsApp.exe]
mov dword [ebp - 0x994], 0xf
movq qword [ebp - 0x9a8], xmm0
mov dword [ebp - 0x9a0], eax
mov byte [ebp - 0x99c], 0
mov byte [ebp - 4], 1
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0x990], xmm0
mov dword [ebp - 0x980], 0
mov dword [ebp - 0x97c], 0xf
call fcn.0049d2fc
movups xmm0, xmmword [str.Malwarebytes.exe]
mov dword [ebp - 0x990], eax
mov dword [ebp - 0x980], 0x10
mov dword [ebp - 0x97c], 0x1f
movups xmmword [eax], xmm0
mov byte [eax + 0x10], 0
mov eax, dword [0x4e74c4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x978], xmm0
mov dword [ebp - 0x970], eax
movq xmm0, qword [str.PostgreSQL.exe]
movzx eax, word [0x4e74c8]
mov dword [ebp - 0x968], 0xe
mov dword [ebp - 0x964], 0xf
movq qword [ebp - 0x978], xmm0
mov word [ebp - 0x96c], ax
mov byte [ebp - 0x96a], 0
mov eax, dword [0x4e74d4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x960], xmm0
mov dword [ebp - 0x958], eax
movq xmm0, qword [str.PowerPoint.exe]
movzx eax, word [0x4e74d8]
mov dword [ebp - 0x950], 0xe
mov dword [ebp - 0x94c], 0xf
movq qword [ebp - 0x960], xmm0
mov word [ebp - 0x954], ax
mov byte [ebp - 0x952], 0
mov eax, dword [0x4e74e4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x948], xmm0
mov dword [ebp - 0x940], eax
movzx eax, word [0x4e74e8]
movq xmm0, qword [str.SublimeText.exe]
mov word [ebp - 0x93c], ax
movzx eax, byte [0x4e74ea]
mov dword [ebp - 0x938], 0xf
mov dword [ebp - 0x934], 0xf
movq qword [ebp - 0x948], xmm0
mov byte [ebp - 0x93a], al
mov byte [ebp - 0x939], 0
movzx eax, word [0x4e74f4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x930], xmm0
mov dword [ebp - 0x920], 0xb
movq xmm0, qword [str.AnyDesk.exe]
mov dword [ebp - 0x91c], 0xf
movq qword [ebp - 0x930], xmm0
mov word [ebp - 0x928], ax
movzx eax, byte [0x4e74f6]
mov byte [ebp - 0x926], al
mov byte [ebp - 0x925], 0
xorps xmm0, xmm0
mov dword [ebp - 0x908], 8
movups xmmword [ebp - 0x918], xmm0
mov dword [ebp - 0x904], 0xf
mov dword [ebp - 0x918], 0x6d6f7441
mov dword [ebp - 0x914], 0x6578652e
mov byte [ebp - 0x910], 0
mov byte [ebp - 4], 7
push 0x20
movups xmmword [ebp - 0x900], xmm0
mov dword [ebp - 0x8f0], 0
mov dword [ebp - 0x8ec], 0xf
call fcn.0049d2fc
movups xmm0, xmmword [str.NotepadPlusPlus.exe]
mov ecx, eax
mov dword [ebp - 0x8f0], 0x13
mov dword [ebp - 0x900], ecx
mov dword [ebp - 0x8ec], 0x1f
movups xmmword [ecx], xmm0
movzx eax, word [0x4e7508]
mov word [ecx + 0x10], ax
movzx eax, byte [0x4e750a]
mov byte [ecx + 0x12], al
mov byte [ecx + 0x13], 0
mov eax, dword [str.PHP.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x8e8], xmm0
mov dword [ebp - 0x8e8], eax
movzx eax, word [0x4e7510]
mov word [ebp - 0x8e4], ax
movzx eax, byte [0x4e7512]
mov dword [ebp - 0x8d8], 7
mov dword [ebp - 0x8d4], 0xf
mov byte [ebp - 0x8e2], al
mov byte [ebp - 0x8e1], 0
mov eax, dword [0x4e751c]
movups xmmword [ebp - 0x8d0], xmm0
mov dword [ebp - 0x8c8], eax
movq xmm0, qword [str.DiskDefrag.exe]
movzx eax, word [0x4e7520]
mov dword [ebp - 0x8c0], 0xe
mov dword [ebp - 0x8bc], 0xf
movq qword [ebp - 0x8d0], xmm0
mov word [ebp - 0x8c4], ax
mov byte [ebp - 0x8c2], 0
xorps xmm0, xmm0
mov dword [ebp - 0x8a8], 8
movups xmmword [ebp - 0x8b8], xmm0
mov dword [ebp - 0x8a4], 0xf
mov dword [ebp - 0x8b8], 0x64726f57
mov dword [ebp - 0x8b4], 0x6578652e
mov byte [ebp - 0x8b0], 0
mov eax, dword [0x4e752c]
movups xmmword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x890], 0xc
movq xmm0, qword [str.Audacity.exe]
mov dword [ebp - 0x88c], 0xf
movq qword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x898], eax
mov byte [ebp - 0x894], 0
mov eax, dword [0x4e753c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x888], xmm0
mov dword [ebp - 0x880], eax
movq xmm0, qword [str.VirtualBox.exe]
movzx eax, word [0x4e7540]
mov dword [ebp - 0x878], 0xe
mov dword [ebp - 0x874], 0xf
movq qword [ebp - 0x888], xmm0
mov word [ebp - 0x87c], ax
mov byte [ebp - 0x87a], 0
mov eax, dword [0x4e754c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x870], xmm0
mov dword [ebp - 0x868], eax
movq xmm0, qword [str.Calculator.exe]
movzx eax, word [0x4e7550]
mov dword [ebp - 0x860], 0xe
mov dword [ebp - 0x85c], 0xf
movq qword [ebp - 0x870], xmm0
mov word [ebp - 0x864], ax
mov byte [ebp - 0x862], 0
mov eax, dword [0x4e755c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x858], xmm0
mov dword [ebp - 0x850], eax
movzx eax, word [0x4e7560]
movq xmm0, qword [str.TortoiseSVN.exe]
mov word [ebp - 0x84c], ax
movzx eax, byte [0x4e7562]
mov dword [ebp - 0x848], 0xf
mov dword [ebp - 0x844], 0xf
movq qword [ebp - 0x858], xmm0
mov byte [ebp - 0x84a], al
mov byte [ebp - 0x849], 0
movzx eax, word [0x4e756c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x840], xmm0
mov dword [ebp - 0x830], 0xa
movq xmm0, qword [str.VSCode.exe]
mov dword [ebp - 0x82c], 0xf
movq qword [ebp - 0x840], xmm0
mov word [ebp - 0x838], ax
mov byte [ebp - 0x836], 0
mov eax, dword [str.SVN.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x828], xmm0
mov dword [ebp - 0x828], eax
movzx eax, word [0x4e7574]
mov word [ebp - 0x824], ax
movzx eax, byte [0x4e7576]
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x814], 0xf
mov byte [ebp - 0x822], al
mov byte [ebp - 0x821], 0
mov eax, dword [0x4e7580]
movups xmmword [ebp - 0x810], xmm0
mov dword [ebp - 0x800], 0xc
movq xmm0, qword [str.WangWang.exe]
mov dword [ebp - 0x7fc], 0xf
movq qword [ebp - 0x810], xmm0
mov dword [ebp - 0x808], eax
mov byte [ebp - 0x804], 0
movzx eax, word [0x4e7590]
xorps xmm0, xmm0
movups xmmword [ebp - 0x7f8], xmm0
mov word [ebp - 0x7f0], ax
movq xmm0, qword [str.Notepad.exe]
movzx eax, byte [0x4e7592]
mov dword [ebp - 0x7e8], 0xb
mov dword [ebp - 0x7e4], 0xf
movq qword [ebp - 0x7f8], xmm0
mov byte [ebp - 0x7ee], al
mov byte [ebp - 0x7ed], 0
movzx eax, word [0x4e759c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x7e0], xmm0
mov word [ebp - 0x7d8], ax
movq xmm0, qword [str.Blender.exe]
movzx eax, byte [0x4e759e]
mov dword [ebp - 0x7d0], 0xb
mov dword [ebp - 0x7cc], 0xf
movq qword [ebp - 0x7e0], xmm0
mov byte [ebp - 0x7d6], al
mov byte [ebp - 0x7d5], 0
movzx eax, word [0x4e75a8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x7c8], xmm0
mov dword [ebp - 0x7b8], 0xa
movq xmm0, qword [str.iTunes.exe]
mov dword [ebp - 0x7b4], 0xf
movq qword [ebp - 0x7c8], xmm0
mov word [ebp - 0x7c0], ax
mov byte [ebp - 0x7be], 0
mov eax, dword [0x4e75b4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x7b0], xmm0
mov dword [ebp - 0x7a0], 0xc
movq xmm0, qword [str.Camtasia.exe]
mov dword [ebp - 0x79c], 0xf
movq qword [ebp - 0x7b0], xmm0
mov dword [ebp - 0x7a8], eax
mov byte [ebp - 0x7a4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x788], 8
movups xmmword [ebp - 0x798], xmm0
mov dword [ebp - 0x784], 0xf
mov dword [ebp - 0x798], 0x5a555043
mov dword [ebp - 0x794], 0x6578652e
mov byte [ebp - 0x790], 0
mov byte [ebp - 4], 0x17
push 0x20
movups xmmword [ebp - 0x780], xmm0
mov dword [ebp - 0x770], 0
mov dword [ebp - 0x76c], 0xf
call fcn.0049d2fc
movups xmm0, xmmword [str.SysInternals.exe]
mov dword [ebp - 0x780], eax
mov dword [ebp - 0x770], 0x10
mov dword [ebp - 0x76c], 0x1f
movups xmmword [eax], xmm0
mov byte [eax + 0x10], 0
mov eax, dword [0x4e75d8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x768], xmm0
mov dword [ebp - 0x760], eax
movzx eax, word [0x4e75dc]
movq xmm0, qword [str.TaskManager.exe]
mov word [ebp - 0x75c], ax
movzx eax, byte [0x4e75de]
mov dword [ebp - 0x758], 0xf
mov dword [ebp - 0x754], 0xf
movq qword [ebp - 0x768], xmm0
mov byte [ebp - 0x75a], al
mov byte [ebp - 0x759], 0
mov eax, dword [0x4e75e8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x750], xmm0
mov dword [ebp - 0x740], 0xc
movq xmm0, qword [str.OneDrive.exe]
mov dword [ebp - 0x73c], 0xf
movq qword [ebp - 0x750], xmm0
mov dword [ebp - 0x748], eax
mov byte [ebp - 0x744], 0
movzx eax, word [0x4e75f8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x738], xmm0
mov word [ebp - 0x730], ax
movq xmm0, qword [str.Outlook.exe]
movzx eax, byte [0x4e75fa]
mov dword [ebp - 0x728], 0xb
mov dword [ebp - 0x724], 0xf
movq qword [ebp - 0x738], xmm0
mov byte [ebp - 0x72e], al
mov byte [ebp - 0x72d], 0
xorps xmm0, xmm0
mov dword [ebp - 0x710], 9
movups xmmword [ebp - 0x720], xmm0
movq xmm0, qword [str.Skype.exe]
movzx eax, byte [0x4e7604]
mov dword [ebp - 0x70c], 0xf
movq qword [ebp - 0x720], xmm0
mov byte [ebp - 0x718], al
mov byte [ebp - 0x717], 0
xorps xmm0, xmm0
mov dword [ebp - 0x6f8], 8
movups xmmword [ebp - 0x708], xmm0
mov dword [ebp - 0x6f4], 0xf
mov dword [ebp - 0x708], 0x616e6953
mov dword [ebp - 0x704], 0x6578652e
mov byte [ebp - 0x700], 0
movzx eax, word [0x4e7610]
movups xmmword [ebp - 0x6f0], xmm0
mov dword [ebp - 0x6e0], 0xa
movq xmm0, qword [str.Winamp.exe]
mov dword [ebp - 0x6dc], 0xf
movq qword [ebp - 0x6f0], xmm0
mov word [ebp - 0x6e8], ax
mov byte [ebp - 0x6e6], 0
mov eax, dword [0x4e761c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x6d8], xmm0
mov dword [ebp - 0x6d0], eax
movq xmm0, qword [str.PowerShell.exe]
movzx eax, word [0x4e7620]
mov dword [ebp - 0x6c8], 0xe
mov dword [ebp - 0x6c4], 0xf
movq qword [ebp - 0x6d8], xmm0
mov word [ebp - 0x6cc], ax
mov byte [ebp - 0x6ca], 0
movzx eax, word [0x4e762c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x6c0], xmm0
mov word [ebp - 0x6b8], ax
movq xmm0, qword [str.Eclipse.exe]
movzx eax, byte [0x4e762e]
mov dword [ebp - 0x6b0], 0xb
mov dword [ebp - 0x6ac], 0xf
movq qword [ebp - 0x6c0], xmm0
mov byte [ebp - 0x6b6], al
mov byte [ebp - 0x6b5], 0
mov byte [ebp - 4], 0x20
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0x6a8], xmm0
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x694], 0xf
call fcn.0049d2fc
movups xmm0, xmmword [str.IntelliJIDEA.exe]
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0x698], 0x10
mov dword [ebp - 0x694], 0x1f
movups xmmword [eax], xmm0
mov byte [eax + 0x10], 0
movzx eax, word [0x4e764c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x690], xmm0
mov word [ebp - 0x688], ax
movq xmm0, qword [str.Spotify.exe]
movzx eax, byte [0x4e764e]
mov dword [ebp - 0x680], 0xb
mov dword [ebp - 0x67c], 0xf
movq qword [ebp - 0x690], xmm0
mov byte [ebp - 0x686], al
mov byte [ebp - 0x685], 0
xorps xmm0, xmm0
mov dword [ebp - 0x668], 8
movups xmmword [ebp - 0x678], xmm0
mov dword [ebp - 0x664], 0xf
mov dword [ebp - 0x678], 0x504d4157
mov dword [ebp - 0x674], 0x6578652e
mov byte [ebp - 0x670], 0
mov eax, dword [0x4e7658]
movups xmmword [ebp - 0x660], xmm0
mov dword [ebp - 0x658], eax
movq xmm0, qword [str.OBSStudio.exe]
movzx eax, byte [0x4e765c]
mov dword [ebp - 0x650], 0xd
mov dword [ebp - 0x64c], 0xf
movq qword [ebp - 0x660], xmm0
mov byte [ebp - 0x654], al
mov byte [ebp - 0x653], 0
mov byte [ebp - 4], 0x24
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0x648], xmm0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
call fcn.0049d2fc
movups xmm0, xmmword [str.DaVinciResolve.exe]
mov ecx, eax
mov dword [ebp - 0x638], 0x12
mov dword [ebp - 0x648], ecx
add esp, 0x14
mov dword [ebp - 0x634], 0x1f
movups xmmword [ecx], xmm0
movzx eax, word [0x4e7670]
mov word [ecx + 0x10], ax
mov byte [ecx + 0x12], 0
mov eax, dword [0x4e767c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x630], xmm0
mov dword [ebp - 0x628], eax
movq xmm0, qword [str.Cinebench.exe]
movzx eax, byte [0x4e7680]
mov dword [ebp - 0x620], 0xd
mov dword [ebp - 0x61c], 0xf
movq qword [ebp - 0x630], xmm0
mov byte [ebp - 0x624], al
mov byte [ebp - 0x623], 0
movzx eax, word [0x4e768c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x618], xmm0
mov dword [ebp - 0x608], 0xa
movq xmm0, qword [str.weChat.exe]
mov dword [ebp - 0x604], 0xf
movq qword [ebp - 0x618], xmm0
mov word [ebp - 0x610], ax
mov byte [ebp - 0x60e], 0
movzx eax, byte [0x4e7698]
xorps xmm0, xmm0
movups xmmword [ebp - 0x600], xmm0
mov dword [ebp - 0x5f0], 9
movq xmm0, qword [str.Slack.exe]
mov dword [ebp - 0x5ec], 0xf
movq qword [ebp - 0x600], xmm0
mov byte [ebp - 0x5f8], al
mov byte [ebp - 0x5f7], 0
push str.Kaspersky.exe
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 0x28
call fcn.00418270
push str.BattleNet.exe
lea ecx, [ebp - 0x5d0]
mov byte [ebp - 4], 0x29
call fcn.00418270
push str.PyCharm.exe
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0x2a
call fcn.00418270
push str.VisualStudio.exe
lea ecx, [ebp - 0x5a0]
mov byte [ebp - 4], 0x2b
call fcn.00418270
push str.HWMonitor.exe
lea ecx, [ebp - 0x588]
mov byte [ebp - 4], 0x2c
call fcn.00418270
push str.Speccy.exe
lea ecx, [ebp - 0x570]
mov byte [ebp - 4], 0x2d
call fcn.00418270
push str.Dropbox.exe
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], 0x2e
call fcn.00418270
push str.Zoom.exe
lea ecx, [ebp - 0x540]
mov byte [ebp - 4], 0x2f
call fcn.00418270
push str.XSplit.exe
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0x30
call fcn.00418270
push str.Avast.exe
lea ecx, [ebp - 0x510]
mov byte [ebp - 4], 0x31
call fcn.00418270
push str.Origin.exe
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x32
call fcn.00418270
push str.AfterEffects.exe
lea ecx, [ebp - 0x4e0]
mov byte [ebp - 4], 0x33
call fcn.00418270
push str.Norton.exe
lea ecx, [ebp - 0x4c8]
mov byte [ebp - 4], 0x34
call fcn.00418270
push str.EpicGamesLauncher.exe
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 0x35
call fcn.00418270
push str.AdobePremierePro.exe
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 0x36
call fcn.00418270
push str.FinalCutPro.exe
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0x37
call fcn.00418270
push str.Lightroom.exe
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x38
call fcn.00418270
push str.IIS.exe
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x39
call fcn.00418270
push str.Python.exe
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x3a
call fcn.00418270
push str.AutoCAD.exe
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 0x3b
call fcn.00418270
push str.QuickTimePlayer.exe
lea ecx, [ebp - 0x408]
mov byte [ebp - 4], 0x3c
call fcn.00418270
push str.Maya.exe
lea ecx, [ebp - 0x3f0]
mov byte [ebp - 4], 0x3d
call fcn.00418270
push str.Illustrator.exe
lea ecx, [ebp - 0x3d8]
mov byte [ebp - 4], 0x3e
call fcn.00418270
push str.McAfee.exe
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x3f
call fcn.00418270
push str.FLStudio.exe
lea ecx, [ebp - 0x3a8]
mov byte [ebp - 4], 0x40
call fcn.00418270
push str.AcrobatReader.exe
lea ecx, [ebp - 0x390]
mov byte [ebp - 4], 0x41
call fcn.00418270
push str.Bitdefender.exe
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0x42
call fcn.00418270
push str.TeamViewer.exe
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 0x43
call fcn.00418270
push str.VLC.exe
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 0x44
call fcn.00418270
push str.Node.exe
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 0x45
call fcn.00418270
push str.Fraps.exe
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 0x46
call fcn.00418270
push str.CCleaner.exe
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0x47
call fcn.00418270
push str.Git.exe
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0x48
call fcn.00418270
push str.3dsMax.exe
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x49
call fcn.00418270
push str.UnrealEngine.exe
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 0x4a
call fcn.00418270
push str.xunfei.exe
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0x4b
call fcn.00418270
mov byte [ebp - 4], 0x4c
push str.VMware.exe
lea ecx, [ebp - 0x288]
call fcn.00418270
push str.CMD.exe
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x4d
call fcn.00418270
push str.Mangoo.exe
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x4e
call fcn.00418270
push str.Paint.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x4f
call fcn.00418270
push str.Apache.exe
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x50
call fcn.00418270
push str.Google.exe
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x51
call fcn.00418270
push str.XAMPP.exe
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x52
call fcn.00418270
push str.MySQL.exe
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x53
call fcn.00418270
push str.NetEase.exe
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x54
call fcn.00418270
push str.FileZilla.exe
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x55
call fcn.00418270
push str.SolidWorks.exe
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x56
call fcn.00418270
push str.Perl.exe
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x57
call fcn.00418270
push str.GIMP.exe
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x58
call fcn.00418270
push str.Inkscape.exe
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x59
call fcn.00418270
push str.Java.exe
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x5a
call fcn.00418270
push str.Teams.exe
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x5b
call fcn.00418270
mov byte [ebp - 4], 0x5c
push str.PuTTY.exe
lea ecx, [ebp - 0x108]
call fcn.00418270
push str.WinSCP.exe
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x5d
call fcn.00418270
push str.Photoshop.exe
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x5e
call fcn.00418270
push str.Uplay.exe
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x5f
call fcn.00418270
push str.Ruby.exe
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x60
call fcn.00418270
push str.GPUZ.exe
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x61
call fcn.00418270
push str.SQLServer.exe
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x62
call fcn.00418270
push str.Firefox.exe
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x63
call fcn.00418270
push str.MongoDB.exe
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x64
call fcn.00418270
push str.Regedit.exe
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x65
call fcn.00418270
lea ecx, [ebp - 0x9c0]
mov dword [ebp - 4], 0x66
push ecx
lea eax, [ebp - 0x18]
push eax
push ecx
lea ecx, [ebp - 0x9d0]
call fcn.00417100
push fcn.00418150
push 0x67
push 0x18
lea eax, [ebp - 0x9c0]
mov byte [ebp - 4], 0x68
push eax
call fcn.0049d33a
push 0
call fcn.004a2977
push eax
call fcn.004ac2ac
add esp, 8
lea ecx, [ebp - 0x9d0]
call fcn.00417040
mov esi, eax
call fcn.004ac28b
xor edx, edx
lea ecx, [ebp - 0x9d0]
div esi
push edx
call fcn.00417020
push eax
mov ecx, edi
call fcn.004182e0
lea ecx, [ebp - 0x9d0]
call fcn.00417080
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049d2bd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret