Function at 0x10016a00
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.100160e0
test eax, eax
jne 0x10017042
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.360desktop
push 0x1009f088
call esi
xor edi, edi
mov ebx, 1
test eax, eax
jne 0x10016a43
push str.360FileBrowser
push 0x1009f088
call esi
test eax, eax
jne 0x10016a43
xor ebp, ebp
jmp 0x10016a45
mov ebp, ebx
call fcn.10035410
xor ecx, ecx
cmp dword [eax], 0x3e7
push 0x100850c8
setne cl
mov dword [0x1009ee68], ecx
call fcn.100029f0
add esp, 4
test al, al
jne 0x10016a83
push 0x10085104
call fcn.100029f0
add esp, 4
mov dword [0x1009ee6c], edi
test al, al
je 0x10016a89
mov dword [0x1009ee6c], ebx
call fcn.1004f4f3
mov dword [0x100a0a08], ebx
call fcn.1006ae30
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1006b660
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.taskmgr.exe
push 0x1009f088
call esi
test eax, eax
jne 0x10016ac2
call fcn.10034d40
jmp 0x10016ad3
cmp dword [0x1009ee78], edi
jne 0x10016ace
cmp ebp, edi
je 0x10016ad3
call fcn.10035250
push str.sldworks.exe
push 0x1009f088
call esi
test eax, eax
jne 0x10016aeb
mov dword [0x1009f294], ebx
jmp 0x10016b19
push str.wpscloudsvr.exe
push 0x1009f088
call esi
test eax, eax
jne 0x10016b03
mov dword [0x100a0298], ebx
jmp 0x10016b19
push str.allegro.exe
push 0x1009f088
call esi
test eax, eax
jne 0x10016b19
mov dword [0x100a029c], ebx
call fcn.1000f6d0
cmp dword [0x1009ee68], edi
je 0x10016e2d
cmp dword [0x1009ee78], edi
jne 0x10016e2d
push 0x1009eb08
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.10035410
mov eax, dword [eax]
mov dword [0x1009b0d8], eax
cmp eax, 2
jne 0x10016b5c
call fcn.10015b60
mov eax, dword [0x1009b0d8]
cmp eax, edi
je 0x10016b6d
cmp eax, ebx
je 0x10016b6d
cmp eax, 2
jne 0x10016e1e
call fcn.10016430
test eax, eax
je 0x10016bee
cmp dword [0x100a02a4], edi
jne 0x10016bee
push 0x100856fc
push str.kernelbase.dll
mov dword [0x100a02a4], edi
call fcn.1006c930
mov dword [0x100a02a0], eax
cmp eax, edi
je 0x10016baf
push 0x10015270
push 0x100a02a0
call fcn.1006b720
test eax, eax
je 0x10016be8
cmp dword [0x100a02a4], edi
jne 0x10016bee
push 0x100856fc
push 0x1008471c
mov dword [0x100a02a4], edi
call fcn.1006c930
mov dword [0x100a02a0], eax
cmp eax, edi
je 0x10016bee
push 0x10015270
push 0x100a02a0
call fcn.1006b720
test eax, eax
jne 0x10016bee
mov dword [0x100a02a4], ebx
mov edx, dword [0x100a02a0]
push str.acad.exe
push 0x1009f088
mov dword [0x100a17a8], edx
call esi
test eax, eax
je 0x10016c2e
push str.x2.exe
push 0x1009f088
call esi
test eax, eax
je 0x10016c2e
push str.Photoshop.exe
push 0x1009f088
call esi
test eax, eax
jne 0x10016d96
cmp dword [0x100a02c4], edi
jne 0x10016ca6
push 0x100857dc
push str.kernelbase.dll
mov dword [0x100a02c4], edi
call fcn.1006c930
mov dword [0x100a02c0], eax
cmp eax, edi
je 0x10016c67
push 0x10015810
push 0x100a02c0
call fcn.1006b720
test eax, eax
je 0x10016ca0
cmp dword [0x100a02c4], edi
jne 0x10016ca6
push 0x100857dc
push 0x1008471c
mov dword [0x100a02c4], edi
call fcn.1006c930
mov dword [0x100a02c0], eax
cmp eax, edi
je 0x10016ca6
push 0x10015810
push 0x100a02c0
call fcn.1006b720
test eax, eax
jne 0x10016ca6
mov dword [0x100a02c4], ebx
cmp dword [0x100a02bc], edi
jne 0x10016d1e
push 0x100857e8
push str.kernelbase.dll
mov dword [0x100a02bc], edi
call fcn.1006c930
mov dword [0x100a02b8], eax
cmp eax, edi
je 0x10016cdf
push 0x10015880
push 0x100a02b8
call fcn.1006b720
test eax, eax
je 0x10016d18
cmp dword [0x100a02bc], edi
jne 0x10016d1e
push 0x100857e8
push 0x1008471c
mov dword [0x100a02bc], edi
call fcn.1006c930
mov dword [0x100a02b8], eax
cmp eax, edi
je 0x10016d1e
push 0x10015880
push 0x100a02b8
call fcn.1006b720
test eax, eax
jne 0x10016d1e
mov dword [0x100a02bc], ebx
cmp dword [0x100a02b4], edi
jne 0x10016d96
push str.MoveFileWithProgressW
push str.kernelbase.dll
mov dword [0x100a02b4], edi
call fcn.1006c930
mov dword [0x100a02b0], eax
cmp eax, edi
je 0x10016d57
push 0x10015900
push 0x100a02b0
call fcn.1006b720
test eax, eax
je 0x10016d90
cmp dword [0x100a02b4], edi
jne 0x10016d96
push str.MoveFileWithProgressW
push 0x1008471c
mov dword [0x100a02b4], edi
call fcn.1006c930
mov dword [0x100a02b0], eax
cmp eax, edi
je 0x10016d96
push 0x10015900
push 0x100a02b0
call fcn.1006b720
test eax, eax
jne 0x10016d96
mov dword [0x100a02b4], ebx
push str.xtop.exe
push 0x1009f088
call esi
test eax, eax
jne 0x10016e1e
cmp dword [0x100a02ac], edi
jne 0x10016e1e
push str.CopyFileExW
push str.kernelbase.dll
mov dword [0x100a02ac], edi
call fcn.1006c930
mov dword [0x100a02a8], eax
cmp eax, edi
je 0x10016ddf
push 0x10015610
push 0x100a02a8
call fcn.1006b720
test eax, eax
je 0x10016e18
cmp dword [0x100a02ac], edi
jne 0x10016e1e
push str.CopyFileExW
push 0x1008471c
mov dword [0x100a02ac], edi
call fcn.1006c930
mov dword [0x100a02a8], eax
cmp eax, edi
je 0x10016e1e
push 0x10015610
push 0x100a02a8
call fcn.1006b720
test eax, eax
jne 0x10016e1e
mov dword [0x100a02ac], ebx
call fcn.100188b0
call fcn.10034100
jmp 0x10016f5e
push 0x1009f088
push str.EnterprisePortal.exe
call esi
test eax, eax
jne 0x10016ede
call fcn.10055f6b
cmp dword [0x100a02cc], edi
jne 0x10016f5e
push 0x10085858
push str.kernelbase.dll
mov dword [0x100a02cc], edi
call fcn.1006c930
mov dword [0x100a02c8], eax
cmp eax, edi
je 0x10016e8e
push 0x100159d0
push 0x100a02c8
call fcn.1006b720
test eax, eax
jne 0x10016e8e
mov dword [0x100a02cc], ebx
jmp 0x10016f5e
cmp dword [0x100a02cc], edi
jne 0x10016f5e
push 0x10085858
push 0x1008471c
mov dword [0x100a02cc], edi
call fcn.1006c930
mov dword [0x100a02c8], eax
cmp eax, edi
je 0x10016f5e
push 0x100159d0
push 0x100a02c8
call fcn.1006b720
test eax, eax
jne 0x10016f5e
mov dword [0x100a02cc], ebx
jmp 0x10016f5e
cmp dword [0x100a0298], edi
je 0x10016f5e
cmp dword [0x100a02ac], edi
jne 0x10016f5e
push str.CopyFileExW
push str.kernelbase.dll
mov dword [0x100a02ac], edi
call fcn.1006c930
mov dword [0x100a02a8], eax
cmp eax, edi
je 0x10016f1f
push 0x10015610
push 0x100a02a8
call fcn.1006b720
test eax, eax
je 0x10016f58
cmp dword [0x100a02ac], edi
jne 0x10016f5e
push str.CopyFileExW
push 0x1008471c
mov dword [0x100a02ac], edi
call fcn.1006c930
mov dword [0x100a02a8], eax
cmp eax, edi
je 0x10016f5e
push 0x10015610
push 0x100a02a8
call fcn.1006b720
test eax, eax
jne 0x10016f5e
mov dword [0x100a02ac], ebx
push str.CryptEnabled
call fcn.100029f0
add esp, 4
test al, al
je 0x10017000
cmp dword [0x1009ee78], edi
je 0x10017008
cmp dword [0x1009b0ec], 0xa
jb 0x10017000
cmp dword [0x100a02a4], edi
jne 0x10017000
push 0x100856fc
push str.kernelbase.dll
mov dword [0x100a02a4], edi
call fcn.1006c930
mov dword [0x100a02a0], eax
cmp eax, edi
je 0x10016fc1
push 0x10015270
push 0x100a02a0
call fcn.1006b720
test eax, eax
je 0x10016ffa
cmp dword [0x100a02a4], edi
jne 0x10017000
push 0x100856fc
push 0x1008471c
mov dword [0x100a02a4], edi
call fcn.1006c930
mov dword [0x100a02a0], eax
cmp eax, edi
je 0x10017000
push 0x10015270
push 0x100a02a0
call fcn.1006b720
test eax, eax
jne 0x10017000
mov dword [0x100a02a4], ebx
cmp dword [0x1009ee78], edi
jne 0x1001700c
cmp ebp, edi
je 0x10017033
cmp dword [0x1009ee70], edi
jne 0x10017033
call fcn.1004f4f3
push edi
push edi
push edi
push 0x100388c0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100a07d4], eax
call fcn.10038a30
call fcn.1001bc00
call fcn.10028620
call fcn.1006b0a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret