Function at 0x1001e856
Capabilities:
Accept command line arguments
Create thread
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x90c
mov eax, dword [0x10084adc]
xor eax, esp
mov dword [esp + 0x908], eax
xor eax, eax
cmp dword [0x10152cdc], eax
jne 0x1001f455
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, str.kernel32.dll
cmp dword [0x10187954], eax
jne 0x1001e946
cmp dword [0x10187958], eax
jne 0x1001e946
push str.Psapi.dll
call edi
mov ebx, eax
test ebx, ebx
je 0x1001e8f4
cmp dword [0x10187954], 0
jne 0x1001e8c8
push str.GetModuleFileNameExA
push ebx
call esi
mov dword [0x10187954], eax
cmp dword [0x10187958], 0
jne 0x1001e8de
push str.GetModuleFileNameExW
push ebx
call esi
mov dword [0x10187958], eax
cmp dword [0x1018795c], 0
jne 0x1001e8f4
push str.GetModuleBaseNameW
push ebx
call esi
mov dword [0x1018795c], eax
xor ebx, ebx
cmp dword [0x10187954], ebx
jne 0x1001e946
cmp dword [0x10187958], ebx
jne 0x1001e946
push str.GetModuleFileNameExA
push ebp
call edi
push eax
call esi
mov dword [0x10187954], eax
cmp dword [0x10187958], ebx
jne 0x1001e92e
push str.GetModuleFileNameExW
push ebp
call edi
push eax
call esi
mov dword [0x10187958], eax
cmp dword [0x1018795c], ebx
jne 0x1001e946
push str.GetModuleBaseNameW
push ebp
call edi
push eax
call esi
mov dword [0x1018795c], eax
push str.chrome.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, 0x10060ec9
mov ebx, reloc.WS2_32.dll_bind
test eax, eax
jne 0x1001ea25
push 0x800
push eax
lea eax, [esp + 0x120]
push eax
call fcn.10045030
add esp, 0xc
cmp dword [0x10154984], 0
jne 0x1001e9bc
push str.Psapi.dll
call edi
mov edi, str.EnumProcessModules
test eax, eax
je 0x1001e99b
push edi
push eax
call esi
mov dword [0x10154984], eax
cmp dword [0x10154984], 0
jne 0x1001e9bc
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov dword [0x10154984], eax
test eax, eax
je 0x1001e9dd
lea eax, [esp + 0x10]
push eax
push 0x800
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10154984]
jmp 0x1001e9df
xor eax, eax
test eax, eax
je 0x1001ea85
mov edi, dword [esp + 0x10]
shr edi, 2
jmp 0x1001ea07
mov eax, dword [esp + edi*4 + 0x118]
test eax, eax
je 0x1001ea07
push str.ChromeMain
push eax
call esi
test eax, eax
jne 0x1001ea0e
dec edi
test edi, edi
jg 0x1001e9f0
jmp 0x1001ea85
cmp dword [0x1015668c], 0
je 0x1001ea25
push str.Found_ChromeMain
push 0
call fcn.100412e2
pop ecx
pop ecx
push 0xe
pop eax
mov esi, 0x10155c28
push esi
mov dword [0x101adad0], eax
mov dword [0x101580ac], eax
mov dword [0x101580c0], eax
lea eax, [esp + 0x18]
push 0x100614c0
push eax
mov byte [0x10078497], 0
call fcn.10045378
push ebp
lea eax, [esp + 0x24]
push eax
mov edi, str.SoftWareTrojanCut_tc_MultiX
push edi
push ebx
call fcn.100422d1
push esi
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10045378
push ebp
lea eax, [esp + 0x40]
push eax
push edi
push ebx
call fcn.100422d1
add esp, 0x38
mov eax, 0x10155628
push 0x12
mov edi, str.remoting_host.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001eaae
push 0x15
mov edi, str.remoting_desktop.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001eb2f
push 0x12
pop eax
push 8
pop ecx
mov esi, str.remoting_host.remoting_desktop.EXE
mov edi, 0x10155c28
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x10155c28
mov dword [0x101adad0], eax
mov dword [0x101580ac], eax
mov dword [0x101580c0], eax
lea eax, [esp + 0x18]
push 0x100614c0
push eax
mov byte [0x10078497], 0
mov byte [0x102d3d93], 1
movsb byte es:[edi], byte [esi]
call fcn.10045378
push ebp
lea eax, [esp + 0x24]
push eax
mov esi, str.SoftWareTrojanCut_tc_MultiX
push esi
push ebx
call fcn.100422d1
push 0x10155c28
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10045378
push ebp
lea eax, [esp + 0x40]
push eax
push esi
push ebx
call fcn.100422d1
add esp, 0x38
mov eax, 0x10155628
mov esi, eax
push 0xd
mov edi, str.explorer.exe
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001eba0
mov esi, 0x10157268
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001eb49
sub eax, edi
push eax
push 0x10155428
push esi
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x1001eba0
push str._syswow64
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001eba0
cmp dword [0x1015668c], 0x88
mov byte [0x1015788a], 1
mov byte [0x10078497], al
jne 0x1001f435
push str.g_sbIsExplorer__true
jmp 0x1001ee29
mov eax, 0x10155628
push 9
mov edi, str.flow.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f3c6
push 0xa
mov edi, 0x10066b2c
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f3c6
push 0xa
mov edi, 0x10067d14
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f3c6
push 9
mov edi, str.lync.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f3c6
push 0xd
mov edi, str.whatsapp.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f3c6
push 0xe
mov edi, str.messenger.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f3c6
push 0xc
mov edi, str.rsuimgr.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f3a4
push 0xc
mov edi, str.rssemgr.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f3a4
push 0xc
mov edi, 0x10067cc4
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f2ee
push 0xf
mov edi, 0x10067cb4
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f2ee
push 0x14
mov edi, 0x10067ca0
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f2ee
push 0xb
mov edi, str.msedge.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ed24
push 0xa
pop eax
mov byte [0x10078497], dl
mov dword [0x101adac8], eax
mov dword [0x10157ca4], eax
mov dword [0x101580ac], eax
mov dword [0x101580c0], eax
cmp dword [0x1015668c], edx
je 0x1001ecc7
push str.g_sbIsIE__MSEDGE
push edx
call fcn.100412e2
pop ecx
pop ecx
push ebp
push str.TC_Edge
push str.SOFTWARETrojanCut_tc_Env
push ebx
call fcn.100422d1
mov esi, 0x10155c28
push esi
lea eax, [esp + 0x28]
push 0x100614c0
push eax
call fcn.10045378
push ebp
lea eax, [esp + 0x34]
push eax
mov edi, str.SoftWareTrojanCut_tc_MultiX
push edi
push ebx
call fcn.100422d1
push esi
lea eax, [esp + 0x44]
push str._s_D
push eax
call fcn.10045378
push ebp
lea eax, [esp + 0x50]
push eax
push edi
push ebx
call fcn.100422d1
add esp, 0x48
jmp 0x1001f435
push 0xd
mov edi, str.iexplore.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ed94
push 0x13
mov edi, str.internet_explorer
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001ed94
xor esi, esi
push esi
push 0x20
push 0x101481e0
push esi
mov byte [0x10078497], dl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 6
pop eax
mov dword [0x101adac8], eax
mov dword [0x10157ca4], eax
mov dword [0x101580ac], eax
cmp dword [0x1015668c], esi
je 0x1001ed82
push str.g_sbIsIE__IE6
push esi
call fcn.100412e2
pop ecx
pop ecx
cmp dword [0x10078cd8], 0xa00
jl 0x1001f435
jmp 0x1001edca
push 0x12
mov edi, str.microsoftedge.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001edb4
push 0x14
mov edi, str.microsoftedgecp.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001edf0
push 0x16
mov edi, str._systemappsmicrosoft
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001edf0
mov byte [0x10078497], dl
cmp dword [0x1015668c], 0
push 7
pop eax
mov dword [0x101adac8], eax
mov dword [0x10157ca4], eax
mov dword [0x101580ac], eax
je 0x1001f435
push str.g_sbIsIE__EDGE
jmp 0x1001ee29
push 0xd
mov edi, str.evernote.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ee37
push 7
pop eax
mov byte [0x10078497], dl
mov dword [0x101adac8], eax
mov dword [0x10157ca4], eax
mov dword [0x101580ac], eax
cmp dword [0x1015668c], edx
je 0x1001f435
push str.g_sbIsIE__EVERNOTE.EXE
push 0
call fcn.100412e2
pop ecx
pop ecx
jmp 0x1001f435
push 0xe
mov edi, str.sdxhelper.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1001f0ea
push 0xc
mov edi, str.wfica32.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ee6a
mov dword [0x10151860], 1
jmp 0x1001f435
mov esi, eax
push 0xa
mov edi, str.mstsc.exe
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001eeaf
mov esi, 0x10156e68
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001ee84
sub eax, edi
push eax
push 0x10155428
push esi
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x1001eeaf
mov byte [0x10078497], al
mov byte [0x10078cb9], al
jmp 0x1001f435
push 0xc
mov edi, str.firefox.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001ef8d
push str.mozilla_firefox
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001ef8d
mov ecx, dword [str.Firefox]
xor eax, eax
inc eax
mov edi, 0x10155c28
push edi
mov dword [0x101adad0], eax
mov dword [0x101580ac], eax
mov dword [0x101580c0], eax
mov dword [0x101481e0], ecx
mov ecx, dword [0x10067b84]
lea eax, [esp + 0x18]
push 0x100614c0
push eax
mov byte [0x10078497], 0
mov dword [0x101481e4], ecx
call fcn.10045378
push ebp
lea eax, [esp + 0x24]
push eax
mov esi, str.SoftWareTrojanCut_tc_MultiX
push esi
push ebx
call fcn.100422d1
push edi
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10045378
push ebp
lea eax, [esp + 0x40]
push eax
push esi
push ebx
call fcn.100422d1
add esp, 0x38
test dword [0x10157880], 0x10000000
je 0x1001ef70
test byte [0x101580d8], 4
je 0x1001f435
lea eax, [esp + 0x10]
push eax
xor eax, eax
push eax
push eax
push 0x1001e790
push eax
push eax
call fcn.1004592d
add esp, 0x18
jmp 0x1001f435
push 0xe
mov edi, str.ucbrowser.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001efc8
push str.ucbrowser
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001efc8
push 8
mov esi, str.UCBrowser
mov edi, 0x101481e0
pop eax
movsd dword es:[edi], dword [esi]
jmp 0x1001f194
push 0xa
mov edi, str.spark.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f04c
push str._baidu
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f04c
push 0xb
pop eax
mov esi, str.Baidu
mov dword [0x101580c0], 0x40
mov edi, 0x101481e0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x10078497], 0
mov dword [0x101580ac], eax
mov dword [0x101adad0], eax
push 0x10155c28
lea eax, [esp + 0x18]
push 0x100614c0
push eax
call fcn.10045378
push ebp
lea eax, [esp + 0x24]
push eax
mov esi, str.SoftWareTrojanCut_tc_MultiX
push esi
push ebx
call fcn.100422d1
push 0x10155c28
jmp 0x1001f416
push 0x15
mov edi, str.plugin_container.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f08d
push str.mozilla_firefox
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f08d
xor eax, eax
inc eax
mov byte [0x10078497], 0
mov dword [0x101580ac], eax
mov dword [0x101adad0], eax
jmp 0x1001f435
push 0x11
mov edi, str.communicator.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f0cb
push 0x10067b04
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f0cb
mov byte [0x10078497], 0
mov dword [0x102b5a38], 8
jmp 0x1001f435
test dword [0x10151868], 0x200000
je 0x1001f0f6
push 0x18
mov edi, str.bitlockerwizardelev.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f0f6
mov byte [0x10078497], 0
jmp 0x1001f435
push 0xa
mov edi, str.opera.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f130
push str.opera
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f130
push 2
pop eax
mov esi, str.OPERA
mov dword [0x101580c0], eax
jmp 0x1001f002
push 0xa
mov edi, str.swing.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f15e
mov esi, str._swing
push esi
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f15e
push 5
pop eax
jmp 0x1001f18f
push 0xa
mov edi, str.whale.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f1ae
mov esi, 0x10067aa8
push esi
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f1ae
push 9
pop eax
mov dword [0x101580c0], eax
mov edi, 0x101481e0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [0x10078497], 0
mov dword [0x101580ac], eax
mov dword [0x101adad0], eax
movsb byte es:[edi], byte [esi]
jmp 0x1001f435
mov eax, 0x10155628
push 0x12
mov edi, str.coolmessenger.exe
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f1d8
mov byte [0x10078497], dl
mov dword [0x101580c0], 0x11
jmp 0x1001f435
mov esi, eax
push 0xb
mov edi, str.chrome.exe
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f22b
push 0x10067a8c
mov esi, 0x10155428
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001f20f
push str.chromium
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f22b
mov esi, str.GoogleChrome
mov edi, 0x101481e0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 3
pop eax
mov dword [0x101580c0], eax
movsw word es:[edi], word [esi]
jmp 0x1001f00b
push 0xb
mov edi, str.safari.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f280
push str._safari
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f280
push 4
pop eax
mov dword [0x101580ac], eax
mov dword [0x101adad0], eax
mov eax, dword [str.Safari]
mov dword [0x101481e0], eax
mov eax, dword [0x10067a58]
mov byte [0x10078497], 0
mov dword [0x101481e4], eax
jmp 0x1001f435
push 0x16
mov edi, str.webkit2webprocess.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f2ce
push str._apple
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f2ce
push 4
mov esi, 0x10067a2c
mov edi, 0x101481e0
movsd dword es:[edi], dword [esi]
pop eax
mov dword [0x101adad0], eax
mov dword [0x101580ac], eax
mov byte [0x10078497], 0
movsw word es:[edi], word [esi]
jmp 0x1001f435
push 0xe
mov edi, str.navertalk.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1001f435
push 5
mov esi, str.Naver
jmp 0x1001f2af
mov esi, eax
push 0xc
mov edi, 0x10067cc4
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov byte [0x10078497], 0
jne 0x1001f383
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x3ff
mov esi, eax
lea eax, [esp + 0x11d]
push 0
push eax
mov byte [esp + 0x124], 0
call fcn.10045030
push esi
call fcn.10045308
push ebp
push 0x100627f4
lea eax, [esp + 0x130]
push eax
push esi
call fcn.10040259
add esp, 0x20
xor eax, eax
mov cl, byte [esp + eax + 0x118]
mov byte [eax + 0x102b5630], cl
inc eax
test cl, cl
jne 0x1001f348
test esi, esi
je 0x1001f383
push str.instagram
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001f383
mov dword [0x102b5a34], 0x20000
mov dword [0x102b5a38], 0x20
push 6
pop ecx
mov esi, str.WWAHOST.EXE.PICKERHOST.EXE
mov edi, 0x10155c28
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [0x101580c0], 0xd
movsb byte es:[edi], byte [esi]
jmp 0x1001f01c
push 6
pop ecx
mov esi, str.RSUIMGR.EXE.RSSEMGR.EXE
mov edi, 0x10155c28
mov byte [0x10078497], 0
mov dword [0x101580c0], 0x80
rep movsd dword es:[edi], dword [esi]
jmp 0x1001f435
mov esi, eax
push 0xa
mov edi, 0x10067d14
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov byte [0x10078497], 0
mov dword [0x101580c0], 0x40
jne 0x1001f3ee
mov byte [0x102d3d93], 1
mov edi, 0x10155c28
push edi
lea eax, [esp + 0x18]
push 0x100614c0
push eax
call fcn.10045378
push ebp
lea eax, [esp + 0x24]
push eax
mov esi, str.SoftWareTrojanCut_tc_MultiX
push esi
push ebx
call fcn.100422d1
push edi
lea eax, [esp + 0x34]
push str._s_D
push eax
call fcn.10045378
push ebp
lea eax, [esp + 0x40]
push eax
push esi
push ebx
call fcn.100422d1
add esp, 0x38
push str.program_fileswindowsapps
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x1001f455
mov byte [0x10078497], 0
mov ecx, dword [esp + 0x908]
xor ecx, esp
call fcn.1004501f
add esp, 0x90c
ret