Function at 0x1001e6d2
Capabilities:
Accept command line arguments
Create thread
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x90c
mov eax, dword [0x10083adc]
xor eax, esp
mov dword [esp + 0x908], eax
xor eax, eax
cmp dword [0x10151cdc], eax
jne 0x1001f2f9
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, str.kernel32.dll
cmp dword [0x10186950], eax
jne 0x1001e7c2
cmp dword [0x10186954], eax
jne 0x1001e7c2
push str.Psapi.dll
call edi
mov ebx, eax
test ebx, ebx
je 0x1001e770
cmp dword [0x10186950], 0
jne 0x1001e744
push str.GetModuleFileNameExA
push ebx
call esi
mov dword [0x10186950], eax
cmp dword [0x10186954], 0
jne 0x1001e75a
push str.GetModuleFileNameExW
push ebx
call esi
mov dword [0x10186954], eax
cmp dword [0x10186958], 0
jne 0x1001e770
push str.GetModuleBaseNameW
push ebx
call esi
mov dword [0x10186958], eax
xor ebx, ebx
cmp dword [0x10186950], ebx
jne 0x1001e7c2
cmp dword [0x10186954], ebx
jne 0x1001e7c2
push str.GetModuleFileNameExA
push ebp
call edi
push eax
call esi
mov dword [0x10186950], eax
cmp dword [0x10186954], ebx
jne 0x1001e7aa
push str.GetModuleFileNameExW
push ebp
call edi
push eax
call esi
mov dword [0x10186954], eax
cmp dword [0x10186958], ebx
jne 0x1001e7c2
push str.GetModuleBaseNameW
push ebp
call edi
push eax
call esi
mov dword [0x10186958], eax
push str.chrome.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, 0x10060ec9
mov ebx, reloc.WS2_32.dll_bind
test eax, eax
jne 0x1001e8a1
push 0x800
push eax
lea eax, [esp + 0x120]
push eax
call fcn.10044b80
add esp, 0xc
cmp dword [0x10153984], 0
jne 0x1001e838
push str.Psapi.dll
call edi
mov edi, str.EnumProcessModules
test eax, eax
je 0x1001e817
push edi
push eax
call esi
mov dword [0x10153984], eax
cmp dword [0x10153984], 0
jne 0x1001e838
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov dword [0x10153984], eax
test eax, eax
je 0x1001e859
lea eax, [esp + 0x10]
push eax
push 0x800
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10153984]
jmp 0x1001e85b
xor eax, eax
test eax, eax
je 0x1001e901
mov edi, dword [esp + 0x10]
shr edi, 2
jmp 0x1001e883
mov eax, dword [esp + edi*4 + 0x118]
test eax, eax
je 0x1001e883
push str.ChromeMain
push eax
call esi
test eax, eax
jne 0x1001e88a
dec edi
test edi, edi
jg 0x1001e86c
jmp 0x1001e901
cmp dword [0x1015568c], 0
je 0x1001e8a1
push str.Found_ChromeMain
push 0
call fcn.1004122a
pop ecx
pop ecx
push 0xe
pop eax
mov esi, 0x10154c28
push esi
mov dword [0x101acac8], eax
mov dword [0x101570ac], eax
mov dword [0x101570c0], eax
lea eax, [esp + 0x18]
push 0x100614b0
push eax
mov byte [0x10077497], 0
call fcn.10044ec8
push ebp
lea eax, [esp + 0x24]
push eax
mov edi, str.SoftWare_trueEP_tc_MultiX
push edi
push ebx
call fcn.10042219
push esi
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x40]
push eax
push edi
push ebx
call fcn.10042219
add esp, 0x38
mov eax, 0x10154628
push 0x12
mov edi, str.remoting_host.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001e92a
push 0x15
mov edi, str.remoting_desktop.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001e9ab
push 0x12
pop eax
push 8
pop ecx
mov esi, str.remoting_host.remoting_desktop.EXE
mov edi, 0x10154c28
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x10154c28
mov dword [0x101acac8], eax
mov dword [0x101570ac], eax
mov dword [0x101570c0], eax
lea eax, [esp + 0x18]
push 0x100614b0
push eax
mov byte [0x10077497], 0
mov byte [0x102d2d93], 1
movsb byte es:[edi], byte [esi]
call fcn.10044ec8
push ebp
lea eax, [esp + 0x24]
push eax
mov esi, str.SoftWare_trueEP_tc_MultiX
push esi
push ebx
call fcn.10042219
push 0x10154c28
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x40]
push eax
push esi
push ebx
call fcn.10042219
add esp, 0x38
mov eax, 0x10154628
mov esi, eax
push 0xd
mov edi, str.explorer.exe
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ea1c
mov esi, 0x10156268
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e9c5
sub eax, edi
push eax
push 0x10154428
push esi
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x1001ea1c
push str._syswow64
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1001ea1c
cmp dword [0x1015568c], 0x88
mov byte [0x1015688a], 1
mov byte [0x10077497], al
jne 0x1001f2f5
push str.g_sbIsExplorer__true
jmp 0x1001eccf
mov eax, 0x10154628
push 9
mov edi, str.flow.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f286
push 0xa
mov edi, 0x10066a44
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f286
push 0xa
mov edi, 0x10067c08
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f286
push 9
mov edi, str.lync.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f286
push 0xd
mov edi, str.whatsapp.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f286
push 0xe
mov edi, str.messenger.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f286
push 0xc
mov edi, str.rsuimgr.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f264
push 0xc
mov edi, str.rssemgr.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f264
push 0xc
mov edi, 0x10067bb8
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f1ae
push 0xf
mov edi, 0x10067ba8
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f1ae
push 0x14
mov edi, 0x10067b94
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f1ae
push 0xb
mov edi, str.msedge.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001eba0
push 0xa
pop eax
mov byte [0x10077497], dl
mov dword [0x101acac0], eax
mov dword [0x10156ca4], eax
mov dword [0x101570ac], eax
mov dword [0x101570c0], eax
cmp dword [0x1015568c], edx
je 0x1001eb43
push str.g_sbIsIE__MSEDGE
push edx
call fcn.1004122a
pop ecx
pop ecx
push ebp
push str.TC_Edge
push str.SOFTWARE_trueEP_tc_Env
push ebx
call fcn.10042219
mov esi, 0x10154c28
push esi
lea eax, [esp + 0x28]
push 0x100614b0
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x34]
push eax
mov edi, str.SoftWare_trueEP_tc_MultiX
push edi
push ebx
call fcn.10042219
push esi
lea eax, [esp + 0x44]
push str._s_D
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x50]
push eax
push edi
push ebx
call fcn.10042219
add esp, 0x48
jmp 0x1001f2f5
push 0xd
mov edi, str.iexplore.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ec3b
push 0x13
mov edi, str.internet_explorer
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001ec3b
xor esi, esi
push esi
push 0x20
push 0x101471e0
push esi
mov byte [0x10077497], dl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 6
pop eax
mov dword [0x101acac0], eax
mov dword [0x10156ca4], eax
mov dword [0x101570ac], eax
cmp dword [0x1015568c], esi
je 0x1001ec02
push str.g_sbIsIE__IE6
push esi
call fcn.1004122a
pop ecx
pop ecx
cmp dword [0x10077cd8], 0xa00
jl 0x1001f2f5
push 7
pop eax
mov dword [0x101acac0], eax
mov dword [0x10156ca4], eax
mov dword [0x101570ac], eax
cmp dword [0x1015568c], esi
je 0x1001f2f5
push str.g_sbIsIE__EDGE
push esi
jmp 0x1001ecd1
push 0x12
mov edi, str.microsoftedge.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001ec5b
push 0x14
mov edi, str.microsoftedgecp.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ec96
push 0x16
mov edi, str._systemappsmicrosoft
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001ec96
push 7
pop eax
mov byte [0x10077497], dl
mov dword [0x101acac0], eax
mov dword [0x10156ca4], eax
mov dword [0x101570ac], eax
cmp dword [0x1015568c], edx
je 0x1001f2f5
push str.g_sbIsIE__EDGE
jmp 0x1001eccf
push 0xd
mov edi, str.evernote.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ecdd
push 7
pop eax
mov byte [0x10077497], dl
mov dword [0x101acac0], eax
mov dword [0x10156ca4], eax
mov dword [0x101570ac], eax
cmp dword [0x1015568c], edx
je 0x1001f2f5
push str.g_sbIsIE__EVERNOTE.EXE
push 0
call fcn.1004122a
pop ecx
pop ecx
jmp 0x1001f2f5
push 0xe
mov edi, str.sdxhelper.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001efaa
push 0xc
mov edi, str.wfica32.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ed10
mov dword [0x10150860], 1
jmp 0x1001f2f5
mov esi, eax
push 0xa
mov edi, str.mstsc.exe
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ed55
mov esi, 0x10155e68
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001ed2a
sub eax, edi
push eax
push 0x10154428
push esi
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x1001ed55
mov byte [0x10077497], al
mov byte [0x10077cb9], al
jmp 0x1001f2f5
push 0xc
mov edi, str.firefox.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ee33
push str.mozilla_firefox
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001ee33
mov ecx, dword [str.Firefox]
xor eax, eax
inc eax
mov esi, 0x10154c28
push esi
mov dword [0x101acac8], eax
mov dword [0x101570ac], eax
mov dword [0x101570c0], eax
mov dword [0x101471e0], ecx
mov ecx, dword [0x10067a78]
lea eax, [esp + 0x18]
push 0x100614b0
push eax
mov byte [0x10077497], 0
mov dword [0x101471e4], ecx
call fcn.10044ec8
push ebp
lea eax, [esp + 0x24]
push eax
mov edi, str.SoftWare_trueEP_tc_MultiX
push edi
push ebx
call fcn.10042219
push esi
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x40]
push eax
push edi
push ebx
call fcn.10042219
add esp, 0x38
test dword [0x10156880], 0x10000000
je 0x1001ee16
test byte [0x101570d8], 4
je 0x1001f2f5
lea eax, [esp + 0x10]
push eax
xor eax, eax
push eax
push eax
push 0x1001e60c
push eax
push eax
call fcn.1004547d
add esp, 0x18
jmp 0x1001f2f5
push 0xe
mov edi, str.ucbrowser.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ee6e
push str.ucbrowser
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001ee6e
push 8
mov esi, str.UCBrowser
mov edi, 0x101471e0
pop eax
movsd dword es:[edi], dword [esi]
jmp 0x1001f054
push 0xa
mov edi, str.spark.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ef0c
push str._baidu
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001ef0c
push 0xb
pop eax
mov esi, str.Baidu
mov dword [0x101570c0], 0x40
mov edi, 0x101471e0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x10077497], 0
mov dword [0x101570ac], eax
mov dword [0x101acac8], eax
push 0x10154c28
lea eax, [esp + 0x18]
push 0x100614b0
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x24]
push eax
mov esi, str.SoftWare_trueEP_tc_MultiX
push esi
push ebx
call fcn.10042219
push 0x10154c28
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x40]
push eax
push esi
jmp 0x1001f2ec
push 0x15
mov edi, str.plugin_container.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ef4d
push str.mozilla_firefox
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001ef4d
xor eax, eax
inc eax
mov byte [0x10077497], 0
mov dword [0x101570ac], eax
mov dword [0x101acac8], eax
jmp 0x1001f2f5
push 0x11
mov edi, str.communicator.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ef8b
push 0x100679f8
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001ef8b
mov byte [0x10077497], 0
mov dword [0x102b4a38], 8
jmp 0x1001f2f5
test dword [0x10150868], 0x200000
je 0x1001efb6
push 0x18
mov edi, str.bitlockerwizardelev.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001efb6
mov byte [0x10077497], 0
jmp 0x1001f2f5
push 0xa
mov edi, str.opera.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001eff0
push str.opera
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001eff0
push 2
pop eax
mov esi, str.OPERA
mov dword [0x101570c0], eax
jmp 0x1001eeac
push 0xa
mov edi, str.swing.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f01e
mov esi, str._swing
push esi
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001f01e
push 5
pop eax
jmp 0x1001f04f
push 0xa
mov edi, str.whale.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f06e
mov esi, 0x1006799c
push esi
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001f06e
push 9
pop eax
mov dword [0x101570c0], eax
mov edi, 0x101471e0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [0x10077497], 0
mov dword [0x101570ac], eax
mov dword [0x101acac8], eax
movsb byte es:[edi], byte [esi]
jmp 0x1001f2f5
mov eax, 0x10154628
push 0x12
mov edi, str.coolmessenger.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f098
mov byte [0x10077497], dl
mov dword [0x101570c0], 0x11
jmp 0x1001f2f5
mov esi, eax
push 0xb
mov edi, str.chrome.exe
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f0eb
push 0x10067980
mov esi, 0x10154428
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1001f0cf
push str.chromium
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001f0eb
mov esi, str.GoogleChrome
mov edi, 0x101471e0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 3
pop eax
mov dword [0x101570c0], eax
movsw word es:[edi], word [esi]
jmp 0x1001eeb5
push 0xb
mov edi, str.safari.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f140
push str._safari
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001f140
push 4
pop eax
mov dword [0x101570ac], eax
mov dword [0x101acac8], eax
mov eax, dword [str.Safari]
mov dword [0x101471e0], eax
mov eax, dword [0x1006794c]
mov byte [0x10077497], 0
mov dword [0x101471e4], eax
jmp 0x1001f2f5
push 0x16
mov edi, str.webkit2webprocess.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f171
push str._apple
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001f171
push 4
mov esi, 0x10067920
jmp 0x1001f18f
push 0xe
mov edi, str.navertalk.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f2f5
push 5
mov esi, str.Naver
mov edi, 0x101471e0
movsd dword es:[edi], dword [esi]
pop eax
mov dword [0x101acac8], eax
mov dword [0x101570ac], eax
mov byte [0x10077497], 0
movsw word es:[edi], word [esi]
jmp 0x1001f2f5
mov esi, eax
push 0xc
mov edi, 0x10067bb8
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov byte [0x10077497], 0
jne 0x1001f243
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x3ff
mov esi, eax
lea eax, [esp + 0x11d]
push 0
push eax
mov byte [esp + 0x124], 0
call fcn.10044b80
push esi
call fcn.10044e58
push ebp
push 0x100627e4
lea eax, [esp + 0x130]
push eax
push esi
call fcn.100401a1
add esp, 0x20
xor eax, eax
mov cl, byte [esp + eax + 0x118]
mov byte [eax + 0x102b4630], cl
inc eax
test cl, cl
jne 0x1001f208
test esi, esi
je 0x1001f243
push str.instagram
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001f243
mov dword [0x102b4a34], 0x20000
mov dword [0x102b4a38], 0x20
push 6
pop ecx
mov esi, str.WWAHOST.EXE.PICKERHOST.EXE
mov edi, 0x10154c28
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [0x101570c0], 0xd
movsb byte es:[edi], byte [esi]
jmp 0x1001eec6
push 6
pop ecx
mov esi, str.RSUIMGR.EXE.RSSEMGR.EXE
mov edi, 0x10154c28
mov byte [0x10077497], 0
mov dword [0x101570c0], 0x80
rep movsd dword es:[edi], dword [esi]
jmp 0x1001f2f5
mov esi, eax
push 0xa
mov edi, 0x10067c08
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov byte [0x10077497], 0
mov dword [0x101570c0], 0x40
jne 0x1001f2ae
mov byte [0x102d2d93], 1
mov esi, 0x10154c28
push esi
lea eax, [esp + 0x18]
push 0x100614b0
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x24]
push eax
mov edi, str.SoftWare_trueEP_tc_MultiX
push edi
push ebx
call fcn.10042219
push esi
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10044ec8
push ebp
lea eax, [esp + 0x40]
push eax
push edi
push ebx
call fcn.10042219
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x908]
xor ecx, esp
call fcn.10044b6f
add esp, 0x90c
ret