Function at 0x10003440
Capabilities:
Get disk information
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48c
mov eax, dword [0x101cc040]
xor eax, esp
mov dword [esp + 0x488], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
mov ebx, ecx
push 0x80000000
push ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, 0xffffffff
je 0x10004c15
push esi
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x3c]
push edx
push edi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10004c0a
mov edx, ebx
mov dword [esp + 0x48], esi
call fcn.10007e70
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x30]
cmp al, 0x4d
jne 0x100034d8
cmp ah, 0x5a
jne 0x10003582
mov esi, 1
jmp 0x1000357e
cmp al, 0x4c
jne 0x100034ff
test ah, ah
jne 0x10003582
cmp byte [esp + 0x32], ah
jne 0x10003582
cmp byte [esp + 0x33], ah
jne 0x10003582
mov esi, 4
jmp 0x1000357e
cmp al, 0x49
jne 0x1000351d
cmp ah, 0x54
jne 0x10003582
cmp byte [esp + 0x32], 0x53
jne 0x10003582
cmp byte [esp + 0x33], 0x46
jne 0x10003582
mov esi, 6
jmp 0x1000357e
cmp al, 0x58
jne 0x1000353b
cmp ah, 0x35
jne 0x10003582
cmp byte [esp + 0x32], 0x4f
jne 0x10003582
cmp byte [esp + 0x33], 0x21
jne 0x10003582
mov esi, 7
jmp 0x1000357e
cmp al, 0xff
jne 0x10003546
cmp ah, 0xfe
je 0x10003579
jmp 0x10003582
cmp al, 0xfe
jne 0x10003551
cmp ah, 0xff
je 0x10003579
jmp 0x10003582
cmp al, 0xef
jne 0x10003563
cmp ah, 0xbb
jne 0x10003582
cmp byte [esp + 0x32], 0xbf
je 0x10003579
jmp 0x10003582
test al, al
jne 0x10003582
test ah, ah
jne 0x10003582
cmp byte [esp + 0x32], 0xfe
jne 0x10003582
cmp byte [esp + 0x33], 0xff
jne 0x10003582
mov esi, 0xa
mov dword [esp + 0x48], esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x34]
mov ebx, eax
mov eax, 0x101ce5b8
mov dword [esp + 0x20], ebx
mov edi, 0x104
sub edx, eax
lea ecx, [edi + 0x7ffffefa]
test ecx, ecx
je 0x100035c1
movzx ecx, word [eax + edx]
test cx, cx
je 0x100035c1
mov word [eax], cx
add eax, 2
sub edi, 1
jne 0x100035a1
jmp 0x100035c5
test edi, edi
jne 0x100035c8
sub eax, 2
xor edx, edx
mov word [eax], dx
xor eax, eax
mov dword [0x101cee48], eax
mov dword [0x101ce5b4], eax
mov dword [0x101ce3e8], eax
mov dword [0x101cea0c], eax
mov dword [0x101ce3ec], eax
cmp ebx, eax
jbe 0x10004c0a
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], eax
cmp esi, 1
jne 0x100040b5
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x8c], edx
call fcn.10006850
mov ecx, dword [esp + 0x58]
mov esi, eax
mov eax, dword [esp + 0x74]
add ecx, 0xc00
xor edx, edx
add esp, 4
cmp edx, eax
mov dword [0x101cee48], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x2c], ecx
sbb ecx, ecx
neg ecx
mov dword [0x101ce3e8], eax
mov eax, dword [esp + 0x50]
mov ebx, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x74]
and ebx, 2
mov dword [esp + 0x18], esi
mov dword [0x101cea0c], ecx
mov dword [0x101ce3ec], eax
mov dword [esp + 0x28], ebx
jne 0x10003677
cmp dword [esp + 0x58], edx
jbe 0x10003677
mov dword [esp + 0x38], 1
cmp esi, 0x16
je 0x1000368b
cmp esi, 0x15
je 0x1000368b
cmp esi, 0x19
je 0x1000368b
cmp esi, 0x1a
jne 0x100036fa
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x90]
mov ecx, eax
mov edx, 0x12c
sub edi, ecx
nop
lea ecx, [edx + 0x7ffffed2]
test ecx, ecx
je 0x100036c0
movzx ecx, word [eax + edi]
test cx, cx
je 0x100036c0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100036a0
jmp 0x100036c4
test edx, edx
jne 0x100036c7
sub eax, 2
xor edx, edx
mov word [eax], dx
lea ecx, [esp + 0x90]
xor eax, eax
push ecx
mov word [esp + 0x9a], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x100036fa
mov dword [esp + 0x18], 0
mov esi, dword [esp + 0x18]
jmp 0x100037cc
cmp esi, 9
jne 0x10003746
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax*4 + 0x101cee50]
push ecx
mov edi, dword [esp + 0x20]
push 0x10143150
mov ecx, 0x40
call fcn.10001100
add esp, 8
mov eax, 0x21
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
cmp esi, 0xa
jne 0x10003755
mov edx, dword [esp + 0x14]
push edx
jmp 0x10004c0f
cmp esi, 0xb
jne 0x1000376c
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Worm.Shortcut.C
jmp 0x10003716
cmp esi, 0xc
jne 0x10003783
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Magadan
jmp 0x10003716
cmp esi, 0x11
jne 0x100037aa
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x68], 4
mov eax, str.FakeFile.B
je 0x100037a4
mov eax, str.FakeFile.A
push eax
jmp 0x10003716
cmp esi, 0x12
jne 0x100037c4
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Trash.A
jmp 0x10003716
test esi, esi
jne 0x100039a4
mov eax, dword [esp + 0x58]
cmp eax, 0x800
jbe 0x100038eb
mov ecx, dword [esp + 0x64]
cmp ecx, 1
je 0x100037ed
cmp ecx, 2
jne 0x100038eb
test ebx, ebx
je 0x100038eb
mov ecx, dword [esp + 0x54]
lea esi, [eax + ecx - 0x800]
mov eax, dword [esp + 0x20]
sub eax, esi
mov edi, 0x800
cmp eax, 0x800
ja 0x10003814
mov edi, eax
push edi
call fcn.1012fc96
mov edx, dword [esp + 0x18]
add esp, 4
push 0
push 0
push esi
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10003838
xor edi, edi
jmp 0x10003854
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
cmp dword [esp + 0x10], 0x800
jb 0x100038da
mov edx, dword [esp + 0x64]
mov eax, dword [0x101ce9d4]
mov esi, dword [0x101cec40]
shl edx, 4
mov dword [esp + 0x40], 1
lea ebx, [edx + eax - 0xc]
sub esi, eax
mov edi, edi
mov eax, dword [esi + ebx]
mov ecx, dword [ebx]
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
mov eax, edi
call fcn.10007da0
add esp, 0xc
mov dword [esp + 0x24], eax
test eax, eax
je 0x100038da
mov eax, dword [esp + 0x40]
inc eax
add ebx, 4
mov dword [esp + 0x40], eax
cmp eax, 4
jbe 0x10003880
push edi
call fcn.1012fc21
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x64], 1
mov eax, str.Conficker.C
je 0x100038d4
mov eax, str.Conficker.B
push eax
jmp 0x10003716
push edi
call fcn.1012fc21
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
add esp, 4
cmp dword [esp + 0x20], 0x2800
ja 0x100039ad
test ebx, ebx
je 0x100039ad
mov edi, dword [esp + 0x20]
push edi
call fcn.1012fc96
mov esi, dword [esp + 0x18]
add esp, 4
push 0
push 0
push 0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000392a
xor edi, edi
jmp 0x10003942
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
mov eax, dword [esp + 0x10]
cmp eax, 0x800
jb 0x10003991
push eax
push edi
mov ebx, str.INTEL_CEDR_STORE
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10003991
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str.TION_PATH
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10003991
push edi
call fcn.1012fc21
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Ramnit.CPL
jmp 0x10003716
push edi
call fcn.1012fc21
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
add esp, 4
jmp 0x100039ad
cmp esi, 6
jne 0x10003bae
mov eax, dword [esp + 0x64]
cmp eax, 5
je 0x100039bf
cmp eax, 4
jne 0x10003bae
test ebx, ebx
jne 0x10003bae
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
cmp ecx, 5
jne 0x10003a62
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x14]
push 0
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x64]
call fcn.100027a0
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov edi, eax
cmp esi, 0x1e
jbe 0x10003a5c
mov edx, dword [0x101cec40]
mov eax, dword [edx + 0x24]
mov ecx, dword [0x101ce9d4]
mov edx, dword [ecx + 0x24]
push eax
push edx
push esi
mov eax, edi
call fcn.10007da0
add esp, 0xc
mov dword [esp + 0x24], eax
test eax, eax
je 0x10003a5c
mov eax, dword [0x101cec40]
mov ecx, dword [eax + 0x28]
mov edx, dword [0x101ce9d4]
mov eax, dword [edx + 0x28]
push ecx
push eax
push esi
mov eax, edi
call fcn.10007da0
add esp, 0xc
mov dword [esp + 0x24], eax
test eax, eax
je 0x10003a5c
mov dword [esp + 0x18], 4
push edi
jmp 0x10003aee
cmp ecx, 4
jne 0x10003afe
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x14]
push ebx
push ecx
mov ecx, eax
mov eax, dword [esp + 0x2c]
call fcn.100027a0
add esp, 0xc
cmp dword [esp + 0x10], 0x1e
mov dword [esp + 0x48], eax
jbe 0x10003ae9
mov eax, dword [0x101ce9d4]
mov esi, dword [0x101cec40]
mov dword [esp + 0x40], 1
lea edi, [eax + 0x2c]
sub esi, eax
jmp 0x10003ab0
mov edx, dword [edi + esi]
mov eax, dword [edi]
mov ecx, dword [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x50]
push ecx
call fcn.10007da0
add esp, 0xc
mov dword [esp + 0x24], eax
test eax, eax
je 0x10003ae9
mov eax, dword [esp + 0x40]
inc eax
add edi, 4
mov dword [esp + 0x40], eax
cmp eax, 4
jbe 0x10003ab0
mov dword [esp + 0x18], 7
mov edx, dword [esp + 0x48]
push edx
call fcn.1012fc21
mov eax, dword [esp + 0x64]
mov esi, dword [esp + 0x1c]
add esp, 4
test esi, esi
jne 0x10003bae
cmp eax, 0x80
jbe 0x10003bae
mov ecx, 0x400
cmp eax, 0x400
jae 0x10003b1f
mov ecx, eax
mov edx, dword [esp + 0x14]
sub ebx, ecx
add ebx, eax
push 0
lea eax, [esp + 0x14]
push ebx
push eax
mov eax, dword [esp + 0x2c]
call fcn.100027a0
mov ecx, dword [str.PADDING]
mov edx, dword [0x101432d8]
mov esi, dword [esp + 0x1c]
mov edi, eax
xor eax, eax
add esp, 0xc
mov dword [esp + 0x41], eax
mov word [esp + 0x45], ax
mov byte [esp + 0x47], al
push 7
lea eax, [esp + 0x44]
push eax
push esi
mov eax, edi
mov byte [esp + 0x4c], 0
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edx
call fcn.10007da0
add esp, 0xc
mov dword [esp + 0x24], eax
test eax, eax
jne 0x10003ba5
push 7
lea ecx, [esp + 0x4c]
push ecx
push esi
mov eax, edi
call fcn.10007da0
add esp, 0xc
mov dword [esp + 0x24], eax
test eax, eax
jne 0x10003ba5
mov dword [esp + 0x18], 1
push edi
call fcn.1012fc21
add esp, 4
mov eax, dword [esp + 0x20]
mov ecx, 0x2800
cmp eax, 0x2800
jae 0x10003bc0
mov ecx, eax
mov edx, eax
sub edx, ecx
push 0
push edx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
call fcn.100027a0
mov ebx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x40], eax
cmp ebx, 0x400
jb 0x10003c98
cmp dword [esp + 0x28], 0
jne 0x10003c98
lea esi, [eax + ebx - 0x400]
mov ecx, 0x100
lea edi, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov edi, 0x400
lea edx, [esp + 0x90]
call fcn.10007af0
mov esi, eax
test esi, esi
je 0x10003c98
mov ecx, edx
push esi
push ecx
mov ebx, str.Word.Document
call fcn.10007c70
add esp, 8
test eax, eax
jne 0x10003c8a
lea edx, [esp + 0x90]
push esi
push edx
mov ebx, str.Microsoft_Office_Word_Document
call fcn.10007c70
add esp, 8
test eax, eax
jne 0x10003c8a
lea eax, [esp + 0x90]
push esi
push eax
mov ebx, str.Excel.Sheet
call fcn.10007c70
add esp, 8
test eax, eax
jne 0x10003c8a
lea ecx, [esp + 0x90]
push esi
push ecx
mov ebx, str.Microsoft_Office_Excel_Worksheet
call fcn.10007c70
add esp, 8
mov dword [esp + 0x24], eax
test eax, eax
je 0x10003c94
mov dword [esp + 0x18], 5
jmp 0x10003cdd
mov ebx, dword [esp + 0x10]
cmp dword [esp + 0x18], 0
jne 0x10003cdd
cmp dword [esp + 0x28], 0
jne 0x10003cdd
cmp ebx, 0x1e
jbe 0x10003cce
mov edx, dword [0x101cec40]
mov eax, dword [edx]
mov ecx, dword [0x101ce9d4]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x44]
push edx
push ebx
call fcn.10007da0
add esp, 0xc
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x10003cdd
mov dword [esp + 0x18], 3
mov eax, dword [esp + 0x40]
push eax
call fcn.1012fc21
mov ecx, dword [esp + 0x30]
add ecx, 0x1000
add esp, 4
cmp dword [esp + 0x20], ecx
jb 0x10004c0a
mov esi, dword [esp + 0x14]
xor edi, edi
cmp dword [0x101ce5a0], edi
jbe 0x10003d39
mov ebx, dword [esp + 0x20]
dec ebx
mov edx, dword [0x101cea2c]
mov eax, dword [edx + edi*4]
add eax, 0x20
cmp eax, ebx
ja 0x10003d30
mov ecx, esi
call fcn.100033a0
test eax, eax
jne 0x10003de5
inc edi
cmp edi, dword [0x101ce5a0]
jb 0x10003d11
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
push ebx
mov edx, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x4c], ebx
call fcn.100030a0
add esp, 4
mov dword [esp + 0x40], eax
mov dword [0x101ce5b4], eax
cmp eax, ebx
je 0x10004c0a
cmp dword [0x101cea14], ebx
jbe 0x10003ed1
mov ecx, dword [0x101ce594]
lea esi, [ebx + 1]
xor edi, edi
lea ebx, [ebx]
mov edx, dword [0x101cea30]
mov eax, dword [esp + 0x40]
cmp dword [edi + edx], eax
jne 0x10003e72
cmp dword [esp + 0x28], 0
jne 0x10003dbe
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push 1
call fcn.100030a0
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
je 0x10004c0a
mov ecx, dword [0x101ce594]
mov edx, dword [0x101cea10]
mov eax, dword [edi + edx]
test eax, eax
jne 0x10003e20
lea eax, [esi - 1]
cmp eax, 0x645
jb 0x10003e70
mov edx, dword [edi + ecx]
cmp edx, dword [esp + 0x20]
jmp 0x10003e6e
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x1c]
mov eax, dword [0x101ce9c8]
mov esi, dword [esp + 0x18]
mov ebx, dword [eax + edi*4]
push 2
push 2
push edx
call fcn.10002840
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
cmp eax, dword [esp + 0x28]
jne 0x10003e72
mov eax, dword [edi + ecx]
test eax, eax
je 0x10003e70
lea edx, [esi - 1]
cmp edx, 0x5cf
jb 0x10003e3e
cmp eax, dword [esp + 0x20]
jmp 0x10003e6e
cmp dword [esp + 0x48], 0
jne 0x10003e67
mov edx, dword [esp + 0x14]
push 2
xor ecx, ecx
call fcn.100030a0
add esp, 4
mov dword [esp + 0x48], eax
test eax, eax
je 0x10004c0a
mov ecx, dword [0x101ce594]
mov eax, dword [esp + 0x48]
cmp dword [edi + ecx], eax
jne 0x10003e72
mov ebx, esi
inc esi
lea edx, [esi - 1]
add edi, 4
cmp edx, dword [0x101cea14]
jb 0x10003d80
test ebx, ebx
jbe 0x10003ed1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x101cea3c]
mov edx, dword [ecx + ebx*4 - 4]
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x101ce9dc]
mov esi, dword [esp + 0x18]
mov ebx, dword [ecx + ebx*4 - 4]
push 2
push edx
push eax
call fcn.10002840
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [0x101ce584], ebx
jbe 0x10003fa3
mov edx, dword [esp + 0x14]
push 3
xor ecx, ecx
call fcn.100030a0
xor edi, edi
add esp, 4
mov esi, eax
cmp dword [0x101ce584], edi
jbe 0x10003fa3
nop
mov edx, dword [0x101cea34]
cmp dword [edx + edi*4], esi
jne 0x10003f3f
cmp dword [esp + 0x48], 0
jne 0x10003f2e
mov edx, dword [esp + 0x14]
push 2
xor ecx, ecx
call fcn.100030a0
add esp, 4
mov dword [esp + 0x48], eax
test eax, eax
je 0x10004c0a
mov eax, dword [0x101cea08]
mov ecx, dword [esp + 0x48]
cmp dword [eax + edi*4], ecx
jne 0x10003f3f
lea ebx, [edi + 1]
inc edi
cmp edi, dword [0x101ce584]
jb 0x10003f00
test ebx, ebx
jbe 0x10003fa3
mov edx, dword [0x101cea34]
mov eax, dword [edx + ebx*4]
push eax
push str.Malwaq._08X
mov ecx, 0x40
lea edi, [esp + 0x58]
call fcn.10001100
mov ecx, dword [esp + 0x1c]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push 2
push 1
push edx
mov ebx, edi
call fcn.10002840
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x40]
xor esi, esi
cmp dword [esi*4 + 0x101ceea0], edi
jne 0x10003fe0
test eax, eax
jne 0x10003fd4
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push 1
call fcn.100030a0
add esp, 4
test eax, eax
je 0x10004c0a
cmp dword [esi*4 + 0x101cf0a0], eax
jne 0x10003fe0
lea ebx, [esi + 1]
inc esi
cmp esi, 0x80
jb 0x10003fad
test ebx, ebx
je 0x10004029
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, dword [ebx*4 + 0x101cea3c]
push 2
push 6
push edx
call fcn.10002840
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x38], 1
jne 0x10004077
cmp dword [esp + 0x3c], 0
jne 0x10004077
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x34]
push eax
push 1
push ecx
call fcn.10002a10
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10004077
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push eax
mov eax, dword [esp + 0x60]
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.10002dc0
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
cmp esi, 7
jne 0x1000413d
mov esi, dword [esp + 0x14]
push 1
lea edx, [esp + 0x14]
push 0
push edx
mov ecx, 0x400
mov eax, ebx
mov edx, esi
call fcn.100027a0
mov edi, eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
push eax
push edi
mov ebx, str.eicar
call fcn.10007c70
push edi
mov ebx, eax
call fcn.1012fc21
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x10004c15
push str.EICAR_AV_Test
mov edi, dword [esp + 0x20]
push 0x10143150
mov ecx, 0x40
call fcn.10001100
add esp, 8
mov eax, 0x29
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
cmp esi, 4
jne 0x100046a2
mov edx, dword [esp + 0x14]
push 1
lea ecx, [esp + 0x14]
push 0
push ecx
mov ecx, 0x2800
mov eax, ebx
call fcn.100027a0
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov edi, eax
push edx
push edi
mov ebx, str.thumb.db
xor esi, esi
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004187
mov esi, str.Yuyun.Shortcut
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str.thumbs.db
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100041a8
mov esi, str.AlbumBokep.Shortcut
jmp 0x10004657
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, 0x1014339c
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100041c9
mov esi, str.VideoFake.Shortcut
jmp 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str.e:VBScript
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100041ea
mov esi, str.Serviks.Shortcut
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str.e:VBS_dekstop.ini
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000420b
mov esi, str.Serviks.Desktopini
jmp 0x10004657
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, str.e:jscript
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000422c
mov esi, str.Annie.Shortcut
jmp 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str._AutoIt3ExecuteScript
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000424d
mov esi, str.Autoit3.Shortcut
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str..a3x
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000426e
mov esi, str.A3X.Shortcut
jmp 0x10004657
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, str.Trashes_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000428f
mov esi, str.Trash.Shortcut.B
jmp 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str..exe__exit
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100042b0
mov esi, str.Trash.Shortcut
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str.cmd.exe
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100042e8
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, str.start
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100042e8
mov esi, str.Houdini.Shortcut
jmp 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str.WTR
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004309
mov esi, str.Stuxnet.Shortcut
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str.fanny.bmp
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000432a
mov esi, str.Fanny.Shortcut
jmp 0x10004657
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, str.mso.sys
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000434b
mov esi, str.MSO.Shortcut
jmp 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str.start__cd_RECYCLER_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000436c
mov esi, str.Recycler.Shortcut
jmp 0x10004657
cmp dword [esp + 0x20], 0xa1
mov eax, dword [esp + 0x10]
jne 0x100043ab
mov byte [edi + eax], 0
mov ecx, dword [esp + 0x10]
lea edx, [edi + ecx - 4]
push edx
mov eax, str..DLL
mov ecx, 5
call fcn.100082e0
add esp, 4
test eax, eax
je 0x10004657
mov esi, str.ShellHole.Shortcut.A
jmp 0x10004657
push eax
push edi
mov ebx, str._systemroot__system32_shell32.dll
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004460
mov ecx, dword [esp + 0x10]
mov byte [edi + ecx], 0
mov ebx, dword [esp + 0x10]
lea edx, [edi + ebx - 0xc]
push edx
mov eax, str.SHELL32.DLL
mov ecx, 0xd
call fcn.100082e0
add esp, 4
test eax, eax
je 0x100043ee
mov esi, str.ShellHole.Shortcut.B
push ebx
push edi
mov ebx, str.rundll32.exe
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str.System32
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004657
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, str.Windows
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, 0x101435c0
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004657
mov esi, str.Bundpil.Shortcut
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str.Microsoft_Windows._Microsoft_Corporation
call fcn.10007c70
add esp, 8
mov ebx, str..cpl
test eax, eax
je 0x1000449c
mov ecx, dword [esp + 0x10]
push ecx
push edi
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004657
mov esi, str.Ramnit.Shortcut
jmp 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
call fcn.10007c70
add esp, 8
test eax, eax
mov eax, dword [esp + 0x10]
je 0x100044e3
mov byte [edi + eax], 0
mov ecx, dword [esp + 0x10]
lea edx, [edi + ecx - 4]
push edx
mov eax, str..cpl
mov ecx, 5
call fcn.100082e0
add esp, 4
test eax, eax
je 0x10004657
mov esi, str.Ramnit_like.Shortcut
jmp 0x10004657
push eax
push edi
mov ebx, str..tmp
call fcn.10007c70
mov ecx, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x10004528
mov byte [edi + ecx], 0
mov edx, dword [esp + 0x10]
lea eax, [edi + edx - 4]
push eax
mov eax, ebx
mov ecx, 5
call fcn.100082e0
add esp, 4
test eax, eax
je 0x10004657
mov esi, str.Stuxnet_like.Shortcut
jmp 0x10004657
push ecx
push edi
mov ebx, str.rundll32.exe
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str.url.dll_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004560
mov esi, str.RunDLL.Shortcut
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str..ini_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004581
mov esi, str.RunDLL.Shortcut.B
jmp 0x10004657
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, str..nil_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100045a2
mov esi, str.RunDLL.Shortcut.D
jmp 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str..fon_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100045c3
mov esi, str.RunDLL.Shortcut.F
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str._crys
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100045e1
mov esi, str.RunDLL.Shortcut.C
jmp 0x10004657
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, str..com_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100045ff
mov esi, str.RunDLL.Shortcut.C2
jmp 0x10004657
mov edx, dword [esp + 0x10]
push edx
push edi
mov ebx, str..init_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000461d
mov esi, str.RunDLL.Shortcut.E
jmp 0x10004657
mov eax, dword [esp + 0x10]
push eax
push edi
mov ebx, str.wscript
call fcn.10007c70
add esp, 8
test eax, eax
je 0x1000463b
mov esi, str.RunDLL.Shortcut.W
jmp 0x10004657
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ebx, str..FAT32_
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004657
mov esi, str.RunDLL.Shortcut.T
push edi
call fcn.1012fc21
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10004675
push esi
jmp 0x1000410d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x34]
push eax
push 4
push ecx
call fcn.10002a10
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x40]
push 0x10143750
push edx
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
je 0x1000482c
mov edx, dword [esp + 0x34]
call fcn.10007fe0
test eax, eax
je 0x10004746
mov edx, 0x104
mov ecx, eax
cmp word [ecx], 0
je 0x100046e5
add ecx, 2
sub edx, 1
jne 0x100046d5
jmp 0x10004746
test edx, edx
je 0x10004746
mov ecx, 0x104
sub ecx, edx
cmp ecx, 0xb
jb 0x10004746
lea ecx, [esp + 0x90]
mov esi, eax
mov eax, ecx
mov edx, 0x100
sub esi, eax
jmp 0x10004710
lea eax, [edx + 0x7ffffefe]
test eax, eax
je 0x10004730
movzx eax, word [esi + ecx]
test ax, ax
je 0x10004730
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10004710
jmp 0x10004734
test edx, edx
jne 0x10004737
sub ecx, 2
xor edx, edx
xor eax, eax
mov word [ecx], dx
mov word [esp + 0x9e], ax
lea ecx, [esp + 0x90]
push str.autorun
push ecx
mov eax, 0x104
call fcn.10008210
add esp, 8
test eax, eax
je 0x1000482c
xor esi, esi
push 1
lea edx, [esp + 0x30]
push esi
push edx
mov edx, dword [esp + 0x20]
mov ecx, 0x100000
mov eax, ebx
mov dword [esp + 0x38], esi
call fcn.100027a0
mov edi, eax
mov eax, dword [esp + 0x38]
add esp, 0xc
push eax
push edi
mov ebx, str.shellexplorecommand
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100047a9
mov esi, str.FFD.Autorun.A
jmp 0x100047e3
mov ecx, dword [esp + 0x2c]
push ecx
push edi
mov ebx, str.shellopencommand
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100047c7
mov esi, str.FFD.Autorun.B
jmp 0x100047e3
mov edx, dword [esp + 0x2c]
push edx
push edi
mov ebx, str.wscript.exe
call fcn.10007c70
add esp, 8
test eax, eax
je 0x100047e3
mov esi, str.FFD.Autorun.C
push edi
call fcn.1012fc21
add esp, 4
test esi, esi
je 0x1000482c
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov edi, dword [esp + 0x20]
push 0x10143150
mov ecx, 0x40
call fcn.10001100
add esp, 8
mov eax, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x20]
sub ecx, 0xa
xor esi, esi
neg ecx
push esi
sbb ecx, ecx
lea edx, [esp + 0x28]
and ecx, 0xfffffbf0
push esi
push edx
mov edx, dword [esp + 0x20]
add ecx, 0x810
mov eax, ebx
mov dword [esp + 0x30], esi
call fcn.100027a0
mov edi, dword [esp + 0x30]
add esp, 0xc
mov edx, eax
mov dword [esp + 0x18], eax
call fcn.10007af0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
push 0x101437b0
push eax
lea eax, [esi + 4]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.10008210
add esp, 8
test eax, eax
jne 0x100048c4
mov edi, dword [esp + 0x40]
push str.html
push edi
lea eax, [esi + 5]
call fcn.10008210
add esp, 8
test eax, eax
jne 0x100048c4
push 0x101437bc
push edi
lea eax, [esi + 4]
call fcn.10008210
add esp, 8
test eax, eax
je 0x1000492f
lea esi, [ebx - 0x800]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x2c], 1
mov ebx, 0x800
cmp eax, 0x800
ja 0x100048e4
mov ebx, eax
push ebx
call fcn.1012fc96
add esp, 4
push 0
push 0
push esi
mov esi, dword [esp + 0x20]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10004908
xor esi, esi
jmp 0x10004920
push 0
lea ecx, [esp + 0x2c]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
mov edi, dword [esp + 0x28]
mov edx, esi
call fcn.10007b80
mov dword [esp + 0x28], eax
xor edi, edi
cmp dword [0x101ce5a8], edi
jbe 0x10004a94
lea ecx, [ecx]
mov edx, dword [0x101ce598]
mov eax, dword [edx + edi*4]
mov al, byte [eax]
cmp al, 0x23
jne 0x100049f1
cmp dword [esp + 0x2c], 0
je 0x10004a87
mov ecx, dword [esp + 0x28]
mov edx, dword [0x101cea38]
mov ebx, dword [edx + edi*4]
push ecx
push esi
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004a87
mov edx, dword [0x101ce598]
mov eax, dword [edx + edi*4]
push eax
push 0x10143150
mov ecx, 0x40
lea edi, [esp + 0x58]
call fcn.10001100
mov ecx, dword [esp + 0x1c]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x18]
push edx
call fcn.1012fc21
add esp, 4
push esi
call fcn.1012fc21
mov eax, edi
mov edi, dword [esp + 0x20]
add esp, 4
push eax
push 0x10143150
mov ecx, 0x40
call fcn.10001100
add esp, 8
mov eax, 0x44
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
cmp al, 0x58
jne 0x10004a64
cmp dword [esp + 0x2c], 0
je 0x10004a87
mov eax, dword [esp + 0x28]
mov ecx, dword [0x101cea38]
mov ebx, dword [ecx + edi*4]
push eax
push esi
call fcn.10007c70
add esp, 8
test eax, eax
je 0x10004a87
mov ecx, dword [0x101ce598]
mov edx, dword [ecx + edi*4]
push edx
push 0x10143150
mov ecx, 0x40
lea edi, [esp + 0x58]
call fcn.10001100
mov eax, dword [esp + 0x1c]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1012fc21
add esp, 4
push esi
call fcn.1012fc21
add esp, 4
mov edx, edi
push edx
jmp 0x100047fc
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [0x101cea38]
mov ebx, dword [ecx + edi*4]
push edx
push eax
call fcn.10007c70
add esp, 8
test eax, eax
jne 0x10004b84
inc edi
cmp edi, dword [0x101ce5a8]
jb 0x10004940
cmp dword [esp + 0x2c], 0
je 0x10004aa4
push esi
call fcn.1012fc21
add esp, 4
mov esi, dword [esp + 0x40]
push 0x101437c8
push esi
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
jne 0x10004ada
push 0x101437cc
push esi
mov eax, 4
call fcn.10008210
add esp, 8
test eax, eax
je 0x10004bfd
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
push edx
push eax
mov ebx, str.ADSUTIL.VBS
call fcn.10007c70
add esp, 8
test eax, eax
jne 0x10004bfd
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
push ecx
push edx
mov ebx, str.Copyright__c_
call fcn.10007c70
add esp, 8
test eax, eax
jne 0x10004bfd
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ebx, str.Regular_Expressions
call fcn.10007c70
add esp, 8
test eax, eax
jne 0x10004bfd
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
sub eax, 0xa
neg eax
sbb eax, eax
and eax, 0xfffffff9
add eax, 0xa
push eax
push edi
call fcn.10004ef0
mov esi, eax
add esp, 8
test esi, esi
je 0x10004bc3
mov edx, dword [esp + 0x18]
push edx
call fcn.1012fc21
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101ce598]
mov ecx, dword [eax + edi*4]
push ecx
push str.VBS._s
mov ecx, 0x40
lea edi, [esp + 0x58]
call fcn.10001100
mov edx, dword [esp + 0x1c]
add esp, 8
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
push eax
call fcn.1012fc21
add esp, 4
mov ecx, edi
push ecx
jmp 0x100047fc
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x34]
push eax
push 3
push edi
call fcn.10002a10
mov ecx, dword [esp + 0x24]
add esp, 0xc
push ecx
mov esi, eax
call fcn.1012fc21
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x488]
xor ecx, esp
call fcn.1012fc12
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x18]
push edx
call fcn.1012fc21
add esp, 4
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x494]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1012fc12
mov esp, ebp
pop ebp
ret