Function at 0x1000f833
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x48c]
sub esp, 0x50c
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x488], eax
push ebx
push esi
push edi
push 0x1005fb94
mov ebx, 0x10142848
push ebx
call fcn.1000740e
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
pop ecx
pop ecx
mov edi, 0x10142448
test eax, eax
jne 0x1000f8c9
mov ecx, 0x10144088
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp - 0x80], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000f87f
sub eax, dword [ebp - 0x80]
push eax
push edi
push ecx
call fcn.10007447
add esp, 0xc
test eax, eax
jne 0x1000f8c9
push str.SysWoW64
push edi
call esi
test eax, eax
jne 0x1000f8c9
inc eax
cmp dword [0x101434ac], 0x88
mov byte [0x10144ec1], al
mov byte [0x10144ec0], al
jne 0x10010026
push str.g_sbIsExplorer__true
jmp 0x1000fba3
push str.FLOW.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000ffa8
push str.SKYPE.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000ffa8
push str.TEAMS.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000ffa8
push str.LYNC.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000ffa8
push str.WHATSAPP.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000ffa8
push str.messenger.exe
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000ffa8
push str.RSUIMGR.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000ff8d
push str.RSSEMGR.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000ff8d
push str.WWAHOST.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000fedf
push 0x1005faec
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000fedf
push str.YOURPHONESERVER.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000fedf
push str.MSEDGE.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fa6c
cmp dword [0x101434ac], 0
push 0xa
pop eax
mov dword [0x101964a0], eax
mov dword [0x10144ec4], eax
mov dword [0x10144ecc], eax
mov dword [0x10144edc], eax
mov byte [0x10072497], 0
je 0x1000f9fa
push str.g_sbIsIE__MSEDGE
push 0
call fcn.1003dfed
pop ecx
pop ecx
mov ebx, 0x1005ce9d
push ebx
push str.TC_Edge
push str.SOFTWARETrojanCut_tc_Env
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.1003ef27
push 0x10142a48
lea eax, [ebp + 0x384]
push 0x1005d458
push eax
call fcn.10040b98
push ebx
lea eax, [ebp + 0x384]
push eax
mov edi, str.SoftWareTrojanCut_tc_MultiX
push edi
push esi
call fcn.1003ef27
push 0x10142a48
lea eax, [ebp + 0x384]
push str._s_D
push eax
call fcn.10040b98
push ebx
lea eax, [ebp + 0x384]
push eax
push edi
push esi
call fcn.1003ef27
add esp, 0x48
jmp 0x10010026
push 0x1005faa0
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fb0c
push str.INTERNET_EXPLORER
push edi
call esi
test eax, eax
je 0x1000fb0c
xor esi, esi
push esi
push 0x20
push 0x101368d0
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 6
pop eax
mov dword [0x101964a0], eax
mov dword [0x10144ec4], eax
mov dword [0x10144ecc], eax
mov byte [0x10072497], 0
cmp dword [0x101434ac], esi
je 0x1000facc
push str.g_sbIsIE__IE6
push esi
call fcn.1003dfed
pop ecx
pop ecx
cmp dword [0x10072cd8], 0xa00
jl 0x10010026
push 7
pop eax
mov dword [0x101964a0], eax
mov dword [0x10144ec4], eax
mov dword [0x10144ecc], eax
mov byte [0x10072497], 0
cmp dword [0x101434ac], esi
je 0x10010026
push str.g_sbIsIE__EDGE
push esi
jmp 0x1000fba5
push 0x1005fa58
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1000fb2e
push 0x1005fa44
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fb67
push str.SystemAppsMicrosoft
push edi
call esi
test eax, eax
je 0x1000fb67
cmp dword [0x101434ac], 0
push 7
pop eax
mov dword [0x101964a0], eax
mov dword [0x10144ec4], eax
mov dword [0x10144ecc], eax
mov byte [0x10072497], 0
je 0x10010026
push str.g_sbIsIE__EDGE
jmp 0x1000fba3
push str.EVERNOTE.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fbb1
cmp dword [0x101434ac], 0
push 7
pop eax
mov dword [0x101964a0], eax
mov dword [0x10144ec4], eax
mov dword [0x10144ecc], eax
mov byte [0x10072497], 0
je 0x10010026
push str.g_sbIsIE__EVERNOTE.EXE
push 0
call fcn.1003dfed
pop ecx
pop ecx
jmp 0x10010026
push str.sdxhelper.exe
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fbcc
mov byte [0x10072497], al
jmp 0x10010026
push str.WFICA32.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fbec
mov dword [0x1013ee88], 1
jmp 0x10010026
push str.MSTSC.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fc32
mov ecx, 0x10143c88
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp - 0x80], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000fc0a
sub eax, dword [ebp - 0x80]
push eax
push edi
push ecx
call fcn.10007447
add esp, 0xc
test eax, eax
jne 0x1000fc32
mov byte [0x10072497], al
mov byte [0x10072cb9], al
jmp 0x10010026
push 0x1005f9e0
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fc7e
push 0x1005f9d0
push edi
call esi
test eax, eax
je 0x1000fc7e
mov ecx, dword [str.Firefox]
mov dword [0x101368d0], ecx
mov ecx, dword [0x1005f9cc]
xor eax, eax
inc eax
mov dword [0x101368d4], ecx
mov dword [0x101964a8], eax
mov dword [0x10144ecc], eax
mov dword [0x10144edc], eax
jmp 0x1000ffca
push 0x1005f9b8
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fcae
push str.UCBrowser
push edi
call esi
test eax, eax
je 0x1000fcae
push 8
mov esi, str.UCBrowser
mov edi, 0x101368d0
pop eax
movsd dword es:[edi], dword [esi]
jmp 0x1000fdd9
push 0x1005f9a0
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fcf5
push 0x1005f998
push edi
call esi
test eax, eax
je 0x1000fcf5
mov esi, 0x1005f998
mov edi, 0x101368d0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xb
pop eax
mov dword [0x10144ecc], eax
mov dword [0x101964a8], eax
movsb byte es:[edi], byte [esi]
mov dword [0x10144edc], 0x40
jmp 0x1000ffca
push str.PLUGIN_CONTAINER.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fd24
push str.MOZILLA_FIREFOX
push edi
call esi
test eax, eax
je 0x1000fd24
xor eax, eax
inc eax
mov dword [0x10144ecc], eax
mov dword [0x101964a8], eax
jmp 0x10010026
push str.Communicator.exe
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fd50
push 0x1005f950
push edi
call esi
test eax, eax
je 0x1000fd50
mov dword [0x1029e3f8], 8
jmp 0x10010026
push 0x1005f944
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fd83
push str.OPERA
push edi
call esi
test eax, eax
je 0x1000fd83
mov esi, str.OPERA
mov edi, 0x101368d0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 2
pop eax
movsb byte es:[edi], byte [esi]
jmp 0x1000fc6a
push str.swing.exe
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fdaa
push str._swing
push edi
call esi
test eax, eax
je 0x1000fdaa
push 5
pop eax
mov esi, str._swing
jmp 0x1000fdd4
push str.whale.exe
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fdec
push str._naver
push edi
call esi
test eax, eax
je 0x1000fdec
push 9
pop eax
mov dword [0x10144edc], eax
mov esi, str._naver
mov edi, 0x101368d0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [0x10144ecc], eax
mov dword [0x101964a8], eax
movsb byte es:[edi], byte [esi]
jmp 0x10010026
push 0x1005f908
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fe42
push str.GoogleChrome
push edi
call esi
test eax, eax
jne 0x1000fe15
push str.Chromium
push edi
call esi
test eax, eax
je 0x1000fe42
mov esi, str.GoogleChrome
mov edi, 0x101368d0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 3
pop eax
mov dword [0x10144ecc], eax
mov dword [0x10144edc], eax
mov dword [0x101964a8], eax
mov byte [0x10072497], 0
movsw word es:[edi], word [esi]
jmp 0x1000ffca
push 0x1005f8e0
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fe85
push str.Safari
push edi
call esi
test eax, eax
je 0x1000fe85
push 4
pop eax
mov dword [0x10144ecc], eax
mov dword [0x101964a8], eax
mov eax, dword [str.Safari]
mov dword [0x101368d0], eax
mov eax, dword [0x1005f8dc]
mov dword [0x101368d4], eax
jmp 0x10010026
push str.WebKit2WebProcess.exe
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000fec1
push str.Apple
push edi
call esi
test eax, eax
je 0x1000fec1
push 4
mov esi, 0x1005f8b0
mov edi, 0x101368d0
movsd dword es:[edi], dword [esi]
pop eax
mov dword [0x101964a8], eax
mov dword [0x10144ecc], eax
movsw word es:[edi], word [esi]
jmp 0x10010026
push 0x1005f8a0
push ebx
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x10010026
push 5
mov esi, 0x1005f898
jmp 0x1000fea9
push str.WWAHOST.EXE
push ebx
call fcn.1000740e
pop ecx
pop ecx
mov ebx, 0x1005ce9d
test eax, eax
jne 0x1000ff59
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x3ff
mov edi, eax
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.10040850
push ebx
push 0x1005e680
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.1003cefb
add esp, 0x1c
xor eax, eax
mov cl, byte [ebp + eax - 0x7c]
mov byte [eax + 0x1029dff0], cl
inc eax
test cl, cl
jne 0x1000ff26
test edi, edi
je 0x1000ff59
push str.Instagram
push edi
call esi
test eax, eax
je 0x1000ff59
mov dword [0x1029e3f4], 0x20000
mov dword [0x1029e3f8], 0x20
push 6
pop ecx
mov esi, str.WWAHOST.EXE.PICKERHOST.EXE
mov edi, 0x10142a48
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x10142a48
lea eax, [ebp + 0x384]
push 0x1005d458
push eax
mov dword [0x10144edc], 0xd
movsb byte es:[edi], byte [esi]
call fcn.10040b98
jmp 0x1000ffe5
push 6
pop ecx
mov esi, str.RSUIMGR.EXE.RSSEMGR.EXE
mov edi, 0x10142a48
mov dword [0x10144edc], 0x80
rep movsd dword es:[edi], dword [esi]
jmp 0x10010026
push str.TEAMS.EXE
push ebx
mov dword [0x10144edc], 0x40
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1000ffca
mov byte [0x102bc549], 1
push 0x10142a48
lea eax, [ebp + 0x384]
push 0x1005d458
push eax
call fcn.10040b98
mov ebx, 0x1005ce9d
push ebx
lea eax, [ebp + 0x384]
push eax
mov edi, str.SoftWareTrojanCut_tc_MultiX
push edi
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.1003ef27
push 0x10142a48
lea eax, [ebp + 0x384]
push str._s_D
push eax
call fcn.10040b98
push ebx
lea eax, [ebp + 0x384]
push eax
push edi
push esi
call fcn.1003ef27
add esp, 0x38
mov ecx, dword [ebp + 0x488]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x48c
leave
ret