Function at 0x1003a62a
Capabilities:
Accept command line arguments
Create thread
Enumerate gui resources
Get common file path
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x4768]
mov eax, 0x47e8
call fcn.10044f70
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x4764], eax
mov eax, dword [ebp + 0x4780]
push ebx
mov ebx, dword [ebp + 0x4778]
push esi
push edi
mov edi, dword [ebp + 0x4784]
push 0x200
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x4564]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], edi
call fcn.10044b80
mov eax, dword [ebp + 0x477c]
push 4
push 0x10063cf8
push ebx
mov dword [ebp - 0x30], eax
call fcn.10046220
add esp, 0x18
lea edx, [ebp + 0x4564]
test eax, eax
jne 0x1003a6b3
lea eax, [ebx + 4]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003a6a7
jmp 0x1003a6c1
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003a6b7
lea eax, [ebp + 0x4564]
push eax
call fcn.10044e58
lea eax, [ebp + 0x4564]
pop ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003a6d7
sub eax, edx
cmp eax, 3
jae 0x1003a6ec
xor eax, eax
jmp 0x1003c067
lea eax, [ebp + 0x4564]
push 0x7c
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
je 0x1003a703
mov byte [eax], 0
cmp dword [0x1015568c], 0
je 0x1003a72b
movzx eax, byte [ebp + 0x4788]
push edi
push eax
lea eax, [ebp + 0x4564]
push eax
push str.SendInfoDisplay_start:_s__d___s_
push 0
call fcn.1004122a
add esp, 0x14
cmp byte [ebp + 0x4788], 0
jne 0x1003a79a
lea eax, [ebp + 0x4564]
push eax
call fcn.10010839
pop ecx
test eax, eax
je 0x1003a79a
mov byte [esi + 0x50bd], 0
mov byte [esi + 0x50bf], 0
test byte [0x102b4a50], 1
je 0x1003a771
mov byte [esi + 0x50bc], 1
mov byte [esi + 0x1470], 1
mov byte [esi + 0x630c], 1
cmp dword [0x1015568c], 0
je 0x1003a790
lea eax, [ebp + 0x4564]
push eax
push str.SendInfoDisplay_dup:_s
push 0
call fcn.1004122a
add esp, 0xc
mov eax, dword [0x102b4a50]
jmp 0x1003c064
cmp byte [0x102b462c], 0
jne 0x1003a835
test byte [0x1014f600], 0x10
je 0x1003a835
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
xor eax, eax
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
xor esi, esi
push esi
push esi
push dword [ebp - 0x50]
call fcn.10047a50
mov ecx, dword [ebp - 0x54]
xor edi, edi
add eax, ecx
adc edx, edi
add eax, 0x5f5e100
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x80]
adc edx, esi
push eax
mov dword [ebp - 0x50], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x1003a85b
mov byte [0x102b462c], al
lea eax, [ebp + 0x4564]
push eax
call fcn.1002de2a
pop ecx
test eax, eax
je 0x1003a8a1
cmp dword [0x1015568c], 0
je 0x1003a6e5
push ebx
push str.isLastXferFilter__s_
jmp 0x1003a892
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x10154a28
push ebx
call esi
test eax, eax
jne 0x1003a879
push str..dll
push ebx
call esi
test eax, eax
je 0x1003a835
cmp dword [0x1015568c], 0
je 0x1003a6e5
lea eax, [ebp + 0x4564]
push eax
push str.SendInfoDisplay_exp:_s
push 0
call fcn.1004122a
add esp, 0xc
jmp 0x1003a6e5
lea eax, [ebp + 0x4564]
push eax
call fcn.100381d1
pop ecx
test al, al
je 0x1003a8c7
cmp dword [0x1015568c], 0
je 0x1003a6e5
push ebx
push str.isWhiteFileExt__s_
jmp 0x1003a892
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x1003a8d3
cmp byte [eax], 0
jne 0x1003a8d9
mov eax, dword [ebp - 0x3c]
add eax, 0x58
mov dword [ebp - 0x5c], eax
mov eax, 0x1000
test dword [ebp + 0x4770], eax
jne 0x1003a8f1
cmp dword [0x102b4a34], eax
jne 0x1003a947
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003a8f6
sub eax, edx
cmp eax, 1
jbe 0x1003a930
cmp byte [ebx + 1], 0x3a
je 0x1003a930
push 0x2e
push ebx
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x1003a930
mov edx, 0x102b4c58
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003a921
jmp 0x1003a846
cmp byte [0x102b4c58], 0
jne 0x1003a947
mov esi, str.BlueTooth
mov edi, 0x102b4c58
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [0x1011fdd0], 0
je 0x1003a9a8
mov edi, dword [ebp - 0x3c]
add edi, 0x58
mov esi, 0x1011fdd0
mov ecx, esi
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1003a97d
test dl, dl
je 0x1003a979
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1003a97d
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x1003a95f
xor eax, eax
jmp 0x1003a982
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1003a9a8
cmp dword [0x1015568c], eax
je 0x1003a6e5
push ebx
push edi
push esi
push str.g_tc_GW__s___s___s_
push eax
call fcn.1004122a
add esp, 0x14
jmp 0x1003a6e5
mov esi, dword [ebp - 0x5c]
push 0xa
mov edi, str.127.0.0.1
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003a9d0
cmp dword [0x1015568c], eax
je 0x1003a6e5
push ebx
push str.127.0.0.1__s_
jmp 0x1003a892
cmp byte [0x10156869], 0
mov eax, dword [ebp + 0x4774]
mov dword [ebp - 0x2c], eax
je 0x1003ab72
xor ecx, ecx
cmp dword [0x10156ca4], ecx
je 0x1003aad3
cmp dword [ebp - 0x34], ecx
je 0x1003aa33
cmp dword [ebp - 0x34], 0x99
je 0x1003aa33
cmp dword [ebp - 0x38], ecx
je 0x1003aa64
mov eax, dword [ebp - 0x38]
cmp byte [eax], cl
je 0x1003aa64
push eax
call fcn.1000309c
pop ecx
test al, al
jne 0x1003aa64
cmp dword [0x1015568c], 0
mov dword [ebp - 0x2c], 1
je 0x1003aa92
push dword [ebp - 0x38]
push str.SendInfoDisplay_PE_IE_cut_sDest:_s
jmp 0x1003aa5a
mov esi, dword [ebp - 0x3c]
add esi, 0x58
push esi
call fcn.1000309c
pop ecx
test al, al
jne 0x1003aac0
cmp dword [0x1015568c], 0
mov dword [ebp - 0x2c], 1
je 0x1003aa92
push esi
push str.SendInfoDisplay_PE_IE_cut_m_szIPAddress:_s
push 0
call fcn.1004122a
add esp, 0xc
cmp dword [0x1015568c], 0
je 0x1003aa92
lea eax, [ebp + 0x4564]
push eax
push dword [0x1015687c]
push dword [ebp - 0x2c]
push dword [ebp + 0x4770]
push str.SendInfoDisplay_1__08x__08x__08x__s
push 0
call fcn.1004122a
add esp, 0x18
test dword [ebp + 0x4770], 0x2000
je 0x1003ac4b
mov eax, dword [0x101570ac]
cmp eax, 3
jle 0x1003ac2c
push dword [0x1015085c]
push 0x10037b44
jmp 0x1003ac3b
cmp dword [0x1015568c], 0
je 0x1003aa92
push str.SendInfoDisplay_PE_IE_OK
jmp 0x1003ab64
cmp byte [0x1015688a], 0
je 0x1003ab72
cmp byte [0x100a19c8], 0
je 0x1003aaf5
cmp dword [0x100774a8], 0x5b6a7988
jne 0x1003aafc
mov dword [ebp - 0x2c], 1
cmp byte [0x100a2648], 0
mov byte [0x100a19c8], 0
je 0x1003ab52
cmp dword [ebp - 0x34], ecx
je 0x1003ab1f
cmp dword [ebp - 0x34], 0x99
je 0x1003ab1f
push dword [ebp - 0x38]
jmp 0x1003ab26
mov eax, dword [ebp - 0x3c]
add eax, 0x58
push eax
call fcn.10003070
pop ecx
test al, al
je 0x1003ab37
mov dword [ebp - 0x2c], 1
cmp dword [0x1015568c], 0
je 0x1003aa92
push str.SendInfoDisplay_disp
push 0
call fcn.1004122a
pop ecx
pop ecx
cmp dword [0x1015568c], 0
je 0x1003aa92
push str.SendInfoDisplay_g_tc_PE_IE__g_sbIsExplorer
push 0
call fcn.1004122a
pop ecx
pop ecx
jmp 0x1003aa64
test dword [0x1014f600], 0x1000
je 0x1003aa64
test al, 1
je 0x1003aa64
cmp dword [ebp - 0x34], 0
je 0x1003aa64
lea eax, [ebp + 0x4564]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003ab9d
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
sub eax, edx
mov esi, eax
push str..EXE
lea eax, [ebp + 0x4564]
push eax
call edi
lea ecx, [ebp + esi + 0x4560]
cmp eax, ecx
je 0x1003abf8
lea eax, [ebp + 0x4564]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003abd0
sub eax, edx
mov esi, eax
push str..DLL
lea eax, [ebp + 0x4564]
push eax
call edi
lea ecx, [ebp + esi + 0x4560]
cmp eax, ecx
jne 0x1003aa64
mov eax, dword [ebp - 0x34]
cmp byte [eax], 0x4d
jne 0x1003aa64
cmp byte [eax + 1], 0x5a
jne 0x1003aa64
cmp dword [0x1015568c], 0
je 0x1003a6e5
lea eax, [ebp + 0x4564]
push eax
push str.SendInfoDisplay_1_1_
jmp 0x1003a892
test eax, eax
je 0x1003ac43
push dword [0x1015085c]
push 0x10037c36
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1003ac4b
push 0
call fcn.10037ac2
pop ecx
movzx ecx, byte [0x101570d1]
mov eax, dword [0x102b4a34]
neg ecx
sbb ecx, ecx
and ecx, 0x2200
or ecx, eax
or ecx, 0x800
or dword [ebp + 0x4770], ecx
cmp dword [0x101570ac], 6
jne 0x1003ac7e
or dword [ebp + 0x4770], eax
mov ecx, dword [ebp - 0x3c]
mov eax, 0x200
test dword [ecx + 0x3ea0], eax
je 0x1003ac94
or dword [ebp + 0x4770], eax
test dword [ebp + 0x4770], 0x1000
je 0x1003acaa
and dword [ebp + 0x4770], 0xffffdfff
cmp dword [0x102b4a38], 0
je 0x1003acbd
or dword [ebp + 0x4770], 0x20000
cmp dword [0x1015568c], 0x11
jne 0x1003acdb
push dword [ebp + 0x4770]
push str._MediaType_0x_08x
push 0
call fcn.1004122a
add esp, 0xc
and dword [0x102b4a34], 0
cmp dword [0x101570c0], 0
mov esi, 0x104
mov ebx, str.SoftWare_trueEP_tc_MultiX
mov edi, reloc.WS2_32.dll_bind
jne 0x1003ad07
cmp byte [0x10151cd8], 0
je 0x1003ade2
push esi
lea eax, [ebp + 0x4260]
push 0
push eax
call fcn.10044b80
push esi
lea eax, [ebp + 0x4060]
push 0
push eax
call fcn.10044b80
push 0x10154c28
lea eax, [ebp + 0x4060]
push str._s_U
push eax
call fcn.10044ec8
push esi
lea eax, [ebp + 0x4260]
push eax
lea eax, [ebp + 0x4060]
push eax
push ebx
push edi
call fcn.1004171d
add esp, 0x38
cmp eax, 0xffffffff
jne 0x1003ad60
mov byte [ebp + 0x4260], 0
cmp dword [0x1015568c], 0
je 0x1003ad86
lea eax, [ebp + 0x4260]
push eax
lea eax, [ebp + 0x4060]
push eax
push str.SendInfoDisplay_sTC_Chrome___s__value__s_
push 0
call fcn.1004122a
add esp, 0x10
cmp byte [0x10150cd0], 0
mov esi, str.mail
je 0x1003ada4
push esi
push 0x10150cd0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003adbf
cmp byte [ebp + 0x4260], 0
je 0x1003adcc
push esi
lea eax, [ebp + 0x4260]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003adcc
mov edi, 0x200
or dword [ebp + 0x4770], edi
jmp 0x1003ade7
push 0x10060ec9
lea eax, [ebp + 0x4060]
push eax
push ebx
push edi
call fcn.10042219
add esp, 0x10
mov edi, 0x200
xor ebx, ebx
cmp dword [0x1015568c], ebx
je 0x1003ae1b
lea eax, [ebp + 0x4564]
push eax
push dword [0x10156874]
push dword [0x1015687c]
push dword [ebp - 0x2c]
push dword [ebp + 0x4770]
push str.SendInfoDisplay_Out__08x__08x__08x__08x__s
push ebx
call fcn.1004122a
add esp, 0x1c
lea eax, [ebp + 0x4564]
mov esi, 0x400
push esi
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x1d60]
push ebx
push eax
call fcn.10044b80
mov ebx, dword [ebp + 0x4770]
add esp, 0xc
mov dword [ebp - 0x40], ebx
and dword [ebp - 0x40], 0x4000000
jne 0x1003aee0
lea eax, [ebp + 0x4564]
push 0x5c
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x1003aee0
push edi
push eax
lea eax, [ebp + 0x4164]
push eax
call fcn.10044b80
add esp, 0xc
lea eax, [ebp + 0x4164]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0x4564]
push eax
lea eax, [ebp + 0x4164]
push eax
lea eax, [ebp + 0x1d60]
push str._s_s
push eax
call fcn.10044ec8
lea eax, [ebp + 0x1d60]
push 0
push eax
call fcn.1004803c
add esp, 0x18
test eax, eax
je 0x1003aed7
lea eax, [ebp + 0x4564]
push eax
mov ecx, 0x10188098
call fcn.1002b502
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x1003aee0
lea eax, [ebp + 0x4564]
jmp 0x1003aedd
lea eax, [ebp + 0x1d60]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
call fcn.1000770a
pop ecx
test eax, eax
je 0x1003aef0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x3c]
call fcn.1003a4d7
test dword [0x1015687c], ebx
je 0x1003b0c4
test dword [0x1016ed68], 0x200
mov esi, 0x10094eb0
mov ebx, 0x1016ed70
je 0x1003af4e
cmp byte [0x1016ed70], 0
je 0x1003af4e
cmp byte [0x10094eb0], 0
je 0x1003af4e
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003af4e
cmp dword [0x1015568c], 0x11
jne 0x1003b136
push esi
push ebx
push str._MediaType_pass_1___S___S_
jmp 0x1003af99
test dword [0x1016ed68], 0x200
mov edi, 0x10155428
je 0x1003afa8
cmp byte [0x10155428], 0
je 0x1003afa8
cmp byte [0x10154a28], 0
je 0x1003afa8
push 0x10154a28
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003afa8
cmp dword [0x1015568c], 0x11
jne 0x1003b136
push 0x10154a28
push edi
push str._MediaType_pass_2___S___S_
push 0
call fcn.1004122a
add esp, 0x10
jmp 0x1003b136
test dword [ebp + 0x4770], 0x10000000
je 0x1003b085
push 0x200
lea eax, [ebp + 0x4364]
push 0
push eax
call fcn.10044b80
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x4564]
push eax
call fcn.10037ca1
add esp, 0x14
cmp byte [ebp + 0x4364], 0
je 0x1003b004
lea eax, [ebp + 0x4364]
push eax
push 0x10180de0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003a6e5
mov eax, dword [0x1016ed68]
test eax, 0x10000
je 0x1003b03e
cmp byte [0x1016ef70], 0
je 0x1003b079
cmp byte [ebp + 0x4364], 0
je 0x1003b079
lea eax, [ebp + 0x4364]
push eax
push 0x1016ef70
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003b136
jmp 0x1003b079
test eax, 0x20000
je 0x1003b079
cmp byte [0x1016ef70], 0
je 0x1003b136
cmp byte [ebp + 0x4364], 0
je 0x1003b136
lea eax, [ebp + 0x4364]
push eax
push 0x1016ef70
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b136
mov dword [ebp - 0x2c], 0x11
jmp 0x1003b136
push 0x11
pop eax
mov dword [ebp - 0x2c], eax
cmp dword [0x1015568c], eax
jne 0x1003b136
push 0x10154a28
push edi
push esi
push ebx
lea eax, [ebp + 0x4564]
push eax
mov eax, dword [0x101570d4]
push esi
push dword [ebp - 0x30]
shl eax, 0xa
push eax
push str.SEND_CUTDEVICE3__08x____08x_host:__s__file:__s__g_tc_OKWebMail:__s__g_szMailFromHost:__s__g_tc_OKMsg:__s__g_szMyExeName:__s_
push 0
call fcn.1004122a
add esp, 0x28
jmp 0x1003b136
mov edx, dword [ebp - 0x30]
mov ecx, dword [0x1016ed68]
mov eax, dword [0x101570d4]
test edx, edx
je 0x1003b0e9
mov ebx, eax
shl ebx, 0xa
cmp ebx, edx
ja 0x1003b0e9
test esi, ecx
je 0x1003b0e9
test byte [ebp - 0x2c], 2
jne 0x1003b106
mov esi, dword [0x101570e0]
shl esi, 0xa
cmp esi, edx
ja 0x1003b136
test ecx, 0x80000
je 0x1003b136
test dword [ebp + 0x4770], edi
je 0x1003b136
cmp dword [0x1015568c], 0x11
mov dword [ebp - 0x2c], 0x21
jne 0x1003b136
lea ecx, [ebp + 0x4564]
push ecx
push 0x10094eb0
push edx
shl eax, 0xa
push eax
push str.SEND_CUTDEVICESIZE4__08x____08x_host:_s_file:_s
push 0
call fcn.1004122a
add esp, 0x18
mov eax, dword [0x10156890]
mov ebx, dword [ebp + 0x4770]
and eax, ebx
push 0x11
pop esi
je 0x1003b151
cmp dword [ebp - 0x40], 0
je 0x1003b151
mov dword [ebp - 0x2c], esi
test eax, eax
je 0x1003b160
test ebx, 0x1000
je 0x1003b160
mov dword [ebp - 0x2c], esi
lea eax, [ebp + 0x4564]
push eax
call fcn.100382c3
pop ecx
test al, al
je 0x1003b174
mov dword [ebp - 0x2c], esi
cmp dword [0x1015568c], 0
mov edi, dword [ebp - 0x58]
je 0x1003b193
push dword [ebp - 0x38]
push edi
push str.SendInfoDisplay_Out_0__s___s_
push 0
call fcn.1004122a
add esp, 0x10
cmp byte [ebp + 0x4788], 0
jne 0x1003b36c
cmp byte [edi + 1], 0x3a
je 0x1003b1af
test byte [ebp + 0x4774], 1
je 0x1003b1c4
cmp dword [0x101570c0], esi
je 0x1003b1c4
cmp dword [0x102b4a38], 0x40
jne 0x1003b36c
push 0x18
call fcn.100472c7
mov esi, eax
pop ecx
test esi, esi
je 0x1003b36c
cmp dword [0x1015568c], 0
je 0x1003b208
push dword [0x102b4a38]
xor eax, eax
push dword [0x101570c0]
cmp byte [edi + 1], 0x3a
push dword [ebp - 0x38]
setne al
push edi
push eax
push str.SendInfoDisplay_Out_wait_5_sec_start__d___s___s___d___d_
push 0
call fcn.1004122a
add esp, 0x1c
xor eax, eax
push 6
pop ecx
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x4774]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x477c]
mov dword [esi + 0xc], eax
lea eax, [ebp + 0x4564]
mov dword [esi], ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003b22e
sub eax, ecx
add eax, 0x200
push eax
call fcn.10044f63
pop ecx
lea ecx, [ebp + 0x4564]
mov dword [esi + 8], eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1003b24f
sub ecx, edi
add ecx, 0x200
push ecx
push 0
push eax
call fcn.10044b80
mov ecx, dword [esi + 8]
add esp, 0xc
lea eax, [ebp + 0x4564]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x1003b273
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x1003b2d4
cmp byte [ebx], dl
je 0x1003b2d4
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003b28d
sub eax, edi
add eax, 0x200
push eax
call fcn.10044f63
pop ecx
mov ecx, ebx
mov dword [esi + 0x10], eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1003b2aa
sub ecx, edi
add ecx, 0x200
push ecx
push 0
push eax
call fcn.10044b80
mov eax, dword [esi + 0x10]
add esp, 0xc
mov edx, ebx
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x1003b2ca
mov ebx, dword [ebp - 0x38]
xor edi, edi
cmp ebx, edi
je 0x1003b330
cmp byte [ebx], 0
je 0x1003b330
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003b2e7
sub eax, edi
add eax, 0x200
push eax
call fcn.10044f63
pop ecx
mov ecx, ebx
mov dword [esi + 0x14], eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1003b304
sub ecx, edi
add ecx, 0x200
push ecx
push 0
push eax
call fcn.10044b80
mov eax, dword [esi + 0x14]
add esp, 0xc
mov edx, ebx
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x1003b324
xor edi, edi
lea eax, [ebp - 0x50]
push eax
push edi
push esi
push 0x1003a18f
push edi
push edi
call fcn.1004547d
add esp, 0x18
mov dword [0x100a1bec], eax
cmp dword [0x1015568c], edi
je 0x1003c061
push dword [ebp - 0x58]
push str.SendInfoDisplay_Out_wait_5_sec__s_
push edi
call fcn.1004122a
add esp, 0xc
jmp 0x1003c061
and dword [ebp - 0x5c], 0
test byte [0x10156880], 1
jne 0x1003b48e
cmp dword [ebp - 0x30], 0xa
jbe 0x1003b48e
lea eax, [ebp + 0x4564]
push eax
call fcn.1003a580
pop ecx
mov edi, 0x200
test al, al
jne 0x1003b493
push edi
lea eax, [ebp + 0x3f64]
push 0
push eax
call fcn.10044b80
push str.AF_FLTR.exe
mov esi, 0x10153e28
push esi
lea eax, [ebp + 0x3f64]
push str.__s_s_
push eax
call fcn.10044ec8
add esp, 0x1c
push str.Program_Files_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
push edi
lea eax, [ebp + 0x4364]
push 0
push eax
call fcn.10044b80
push dword [ebp - 0x48]
lea eax, [ebp + 0x4364]
push str._r___s_
push eax
call fcn.10044ec8
mov ebx, 0x91
add esp, 0x18
cmp dword [0x1015568c], ebx
jne 0x1003b42b
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x3f64]
push eax
push str._ShellExec_4_chk_PerInfo__s__sFName_s
push 0
call fcn.1004122a
add esp, 0x10
push 0
push esi
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x3f64]
push eax
push str.open
push 0
push 0x1e
call fcn.1000d9a2
add esp, 0x1c
cmp eax, 0x3e7
jne 0x1003b493
cmp dword [0x1015568c], ebx
jne 0x1003b46e
push dword [ebp - 0x48]
push str._Found_a_Personal_Information__s
push 0
call fcn.1004122a
add esp, 0xc
test byte [0x10156890], 1
je 0x1003b47e
mov dword [ebp - 0x2c], 0x11
or dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x5c], 1
jmp 0x1003b493
mov edi, 0x200
test byte [ebp - 0x2c], 1
je 0x1003b531
mov eax, dword [ebp - 0x38]
xor ecx, ecx
test eax, eax
je 0x1003b4af
cmp byte [eax], cl
je 0x1003b4af
mov esi, dword [ebp - 0x3c]
jmp 0x1003b4ba
mov esi, dword [ebp - 0x3c]
lea eax, [esi + 0x58]
cmp byte [eax], 0
je 0x1003b4bc
mov ecx, eax
cmp dword [0x10156874], 2
push 0x42
pop ebx
jne 0x1003b4cd
mov dword [ebp - 0x2c], ebx
jmp 0x1003b502
test ecx, ecx
je 0x1003b502
push 0x1015b828
push 0x1015b9b8
push ecx
call fcn.10011181
add esp, 0xc
test al, al
je 0x1003b502
cmp dword [0x1015568c], 0x11
mov dword [ebp - 0x2c], ebx
jne 0x1003b502
push str.SendInfoDisplay_disp_13
push 0
call fcn.1004122a
pop ecx
pop ecx
cmp byte [0x1015bb48], 0
je 0x1003b522
push 0x10154a28
push 0x1015bb48
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b522
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x5c], 1
jne 0x1003b571
or dword [ebp - 0x2c], 0x100
jmp 0x1003b571
mov eax, dword [0x10156880]
mov ecx, eax
and ecx, dword [ebp + 0x4770]
test ecx, 0xfffbffff
je 0x1003b56e
cmp dword [0x1015568c], 0
je 0x1003a6e5
push dword [ebp + 0x4770]
push eax
push str.SendInfoDisplay_Except:_d__d_
push 0
call fcn.1004122a
add esp, 0x10
jmp 0x1003a6e5
mov esi, dword [ebp - 0x3c]
cmp byte [0x101570e7], 0
je 0x1003b596
push str.common.exe
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1003b596
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
and dword [ebp - 0x40], 1
je 0x1003b5b7
mov byte [esi + 0x50bc], 1
mov byte [esi + 0x1470], 1
mov byte [esi + 0x630c], 1
mov dword [0x102b4a50], eax
lea eax, [ebp + 0x4564]
push eax
mov byte [esi + 0x50bd], 0
mov byte [esi + 0x50bf], 0
call fcn.100106cd
pop ecx
test eax, eax
je 0x1003b5e3
mov eax, dword [ebp - 0x40]
jmp 0x1003c067
cmp dword [0x1015568c], 0
je 0x1003b602
lea eax, [ebp + 0x4564]
push eax
push str.SendInfoDisplay_disp_3:_s
push 0
call fcn.1004122a
add esp, 0xc
push edi
xor ebx, ebx
lea eax, [ebp + 0x2160]
push ebx
push eax
call fcn.10044b80
mov eax, dword [0x1015085c]
add eax, 0xea60
push eax
mov esi, 0x10061178
lea eax, [ebp + 0x2160]
push esi
push eax
call fcn.10044ec8
push edi
lea eax, [ebp + 0x3564]
push ebx
push eax
call fcn.10044b80
push edi
lea eax, [ebp + 0x3b64]
push ebx
push eax
call fcn.10044b80
push edi
lea eax, [ebp + 0x3764]
push ebx
push eax
call fcn.10044b80
push 0x1388
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.10044b80
add esp, 0x48
mov ebx, 0xa00
push ebx
lea eax, [ebp + 0x1360]
push 0
push eax
call fcn.10044b80
push ebx
lea eax, [ebp + 0x2764]
push 0
push eax
call fcn.10044b80
mov eax, dword [0x102b4a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x3564]
push str.SoftWare_trueEP_tc_Files
push eax
mov ebx, edx
add ebx, 0x64
inc dword [0x102b4a40]
mov dword [ebp - 0x50], ebx
call fcn.10044ec8
push ebx
lea eax, [ebp + 0x3764]
push esi
push eax
call fcn.10044ec8
lea eax, [ebp + 0x3b64]
push eax
call fcn.10040e5b
lea eax, [ebp + 0x3b64]
push eax
call fcn.1003839d
mov eax, dword [ebp - 0x2c]
push edi
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0x3964]
push 0
push eax
call fcn.10044b80
add esp, 0x40
lea eax, [ebp - 0x70]
push eax
call fcn.1004532b
lea eax, [ebp - 0x70]
push eax
call fcn.10045304
pop ecx
pop ecx
test eax, eax
je 0x1003b728
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x3964]
push edi
push eax
call fcn.10045fb5
add esp, 0x10
jmp 0x1003b73b
lea eax, [ebp + 0x3964]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
push 0x401
xor esi, esi
lea eax, [ebp + 0x2360]
push esi
push eax
call fcn.10044b80
add esp, 0xc
test dword [0x10077cc0], 0x2000
je 0x1003b776
cmp dword [ebp - 0x34], esi
je 0x1003b776
push edi
lea eax, [ebp + 0x2360]
push eax
push dword [ebp - 0x34]
call fcn.100408a7
add esp, 0xc
mov ebx, 0x88
cmp dword [ebp - 0x40], esi
je 0x1003b91e
test byte [0x10077cc8], 2
je 0x1003b91e
lea eax, [ebp + 0x1360]
push 0xa00
push eax
call fcn.1003372f
pop ecx
pop ecx
cmp dword [0x1015568c], ebx
jne 0x1003b7b9
push str.SendInfoDisplay_disp_6
push esi
call fcn.1004122a
pop ecx
pop ecx
push edi
lea eax, [ebp + 0x4364]
push esi
push eax
call fcn.10044b80
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x3b64]
push eax
call fcn.10040d71
add esp, 0x14
cmp dword [0x1015568c], ebx
jne 0x1003b7f2
push str.SendInfoDisplay_disp_66
push esi
call fcn.1004122a
pop ecx
pop ecx
cmp byte [0x102b4630], 0
je 0x1003b80f
xor eax, eax
mov cl, byte [eax + 0x102b4630]
mov byte [ebp + eax + 0x3b64], cl
inc eax
test cl, cl
jne 0x1003b7fd
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.rundll32.exe
lea eax, [ebp + 0x3b64]
push eax
call esi
test eax, eax
jne 0x1003b887
push str.dllhost.exe
lea eax, [ebp + 0x3b64]
push eax
call esi
test eax, eax
jne 0x1003b887
push str.svchost.exe
lea eax, [ebp + 0x3b64]
push eax
call esi
test eax, eax
jne 0x1003b887
lea eax, [ebp + 0x1360]
push eax
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x3b64]
push eax
call fcn.1000770a
pop ecx
push eax
lea eax, [ebp + 0x3b64]
push eax
lea eax, [ebp + 0x2764]
push str._s__d__s__s
push eax
call fcn.10044ec8
add esp, 0x18
jmp 0x1003b908
push 0x400
lea eax, [ebp + 0x3164]
push 0
push eax
call fcn.10044b80
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp + 0x3164]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x1003b8a9
lea eax, [ebp + 0x3164]
push 0x20
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x1003b8cf
lea eax, [ebp + 0x3164]
jmp 0x1003b8d0
inc eax
lea ecx, [ebp + 0x1360]
push ecx
push eax
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x3b64]
push eax
call fcn.1000770a
pop ecx
push eax
lea eax, [ebp + 0x3b64]
push eax
lea eax, [ebp + 0x2764]
push str._s__d__s__s_0___s
push eax
call fcn.10044ec8
add esp, 0x1c
cmp dword [0x1015568c], ebx
jne 0x1003b950
push str.SendInfoDisplay_disp_666
push 0
call fcn.1004122a
jmp 0x1003b94e
cmp byte [0x102b4630], 0
je 0x1003b93b
xor eax, eax
mov cl, byte [eax + 0x102b4630]
mov byte [ebp + eax + 0x3b64], cl
inc eax
test cl, cl
jne 0x1003b929
lea eax, [ebp + 0x3b64]
push eax
lea eax, [ebp + 0x2764]
push eax
call fcn.1000789a
pop ecx
pop ecx
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x40], esi
and dword [ebp - 0x40], 1
je 0x1003b987
push edi
lea eax, [ebp + 0x3d64]
push eax
push str.tc_PerTxt
push str.SOFTWARE_trueEPTC_FLT
push reloc.WS2_32.dll_bind
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1003b987
mov byte [ebp + 0x3d64], 0
mov eax, dword [0x1015568c]
cmp eax, ebx
je 0x1003b99a
cmp eax, 0x44
je 0x1003b99a
cmp eax, 2
jne 0x1003b9b7
lea eax, [ebp + 0x4564]
push eax
lea eax, [ebp + 0x2764]
push eax
push str._tSendInfoDisplay_:__s__s_
push 0
call fcn.1004122a
add esp, 0x10
push str.rdpclip.exe
push 0x10154a28
call fcn.100077d0
cmp dword [ebp - 0x38], 0
pop ecx
pop ecx
je 0x1003ba6a
test eax, eax
jne 0x1003b9ef
push str._tsclient
push dword [ebp - 0x38]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b9ef
mov dword [ebp - 0x2c], 2
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp + 0x2764]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003b9fb
sub eax, edx
cmp eax, 0xa00
jbe 0x1003ba11
mov byte [ebp + 0x3163], cl
push edi
lea eax, [ebp + 0x3d64]
push 0
push eax
call fcn.10044b80
add esp, 0xc
cmp dword [0x102b4a38], 0x40
jne 0x1003ba94
cmp byte [0x102b4a58], 0
je 0x1003ba94
xor eax, eax
mov cl, byte [eax + 0x102b4a58]
mov byte [ebp + eax + 0x3d64], cl
inc eax
test cl, cl
jne 0x1003ba37
cmp dword [0x1015568c], 0
je 0x1003babe
lea eax, [ebp + 0x3d64]
push eax
push str.ssDest__s_
push 0
call fcn.1004122a
add esp, 0xc
jmp 0x1003babe
test eax, eax
jne 0x1003b9ef
mov ebx, dword [ebp - 0x3c]
push str._tsclient
lea eax, [ebx + 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b9f2
mov dword [ebp - 0x2c], 2
jmp 0x1003b9f2
mov eax, dword [ebp - 0x38]
lea edx, [ebp + 0x3d64]
test eax, eax
je 0x1003baaf
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003baa3
jmp 0x1003babe
lea eax, [ebx + 0x58]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003bab4
push str.sLog_ThreeTime_SIZE_3
xor edi, edi
inc edi
push edi
push edi
push edi
push 0
call fcn.1000150f
add esp, 0x14
test eax, eax
je 0x1003baec
lea eax, [ebp + 0x3d64]
push eax
call fcn.10033b7e
pop ecx
test al, al
jne 0x1003a6e5
mov eax, dword [0x10150868]
and eax, edi
je 0x1003bb04
xor edi, edi
cmp dword [ebp - 0x40], edi
je 0x1003bb06
lea eax, [ebp + 0x3d64]
jmp 0x1003bb26
xor edi, edi
cmp eax, edi
je 0x1003bb6d
test dword [0x10077cc0], 0x2000
je 0x1003bb21
lea eax, [ebp + 0x2360]
cmp dword [ebp - 0x34], edi
jne 0x1003bb26
mov eax, 0x10060ec9
or esi, dword [ebp + 0x4770]
push 0x1014d918
push eax
push esi
push dword [ebx + 0x8b2c]
lea eax, [ebp + 0x3d64]
push eax
push dword [ebp - 0x30]
lea eax, [ebp + 0x2764]
push dword [ebp - 0x48]
push eax
push dword [ebp - 0x64]
lea eax, [ebp + 0x3964]
push eax
lea eax, [ebp - 0x28]
push str._s_d_s_s_d_s_d_d_s_s
push eax
call fcn.10044ec8
add esp, 0x30
jmp 0x1003bc0a
mov ecx, dword [ebp + 0x4770]
test ecx, 0x1000
je 0x1003bba8
test dword [0x10077cc0], 0x2000
je 0x1003bb92
lea eax, [ebp + 0x2360]
cmp dword [ebp - 0x34], edi
jne 0x1003bb97
mov eax, 0x10060ec9
push eax
or esi, ecx
push esi
push dword [ebx + 0x8b2c]
push 0x102b4c58
jmp 0x1003bbe2
cmp dword [ebp - 0x40], edi
je 0x1003bbb5
lea eax, [ebp + 0x3d64]
jmp 0x1003bbd1
test dword [0x10077cc0], 0x2000
je 0x1003bbcc
lea eax, [ebp + 0x2360]
cmp dword [ebp - 0x34], edi
jne 0x1003bbd1
mov eax, 0x10060ec9
push eax
or esi, ecx
push esi
push dword [ebx + 0x8b2c]
lea eax, [ebp + 0x3d64]
push eax
push dword [ebp - 0x30]
lea eax, [ebp + 0x2764]
push dword [ebp - 0x48]
push eax
push dword [ebp - 0x64]
lea eax, [ebp + 0x3964]
push eax
lea eax, [ebp - 0x28]
push str._s_d_s_s_d_s_d_d_s
push eax
call fcn.10044ec8
add esp, 0x2c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x3764]
push eax
lea eax, [ebp + 0x3564]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.10042219
mov eax, dword [0x1015568c]
add esp, 0x10
cmp eax, 0x88
je 0x1003bc40
cmp eax, 0x44
je 0x1003bc40
cmp eax, 2
jne 0x1003bc60
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x3764]
push eax
lea eax, [ebp + 0x3564]
push eax
push str.SendInfoDisplay_disp_sKey_:__s_sVal_:__s_sData_:__s
push edi
call fcn.1004122a
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARE_trueEP_tc_Env
push esi
call fcn.10041961
add esp, 0x10
cmp dword [0x101570c0], edi
je 0x1003bcff
mov ecx, dword [0x10077cc0]
mov eax, 0x5000
and ecx, eax
cmp ecx, eax
jne 0x1003bcff
mov ebx, 0x104
push ebx
lea eax, [ebp + 0x4060]
push 0
push eax
call fcn.10044b80
push 0x10154c28
lea eax, [ebp + 0x4060]
push 0x100614b0
push eax
call fcn.10044ec8
push 0x10060ec9
lea eax, [ebp + 0x4060]
push eax
push str.SoftWare_trueEP_tc_MultiX
push reloc.WS2_32.dll_bind
call fcn.10042219
mov eax, dword [0x1015568c]
add esp, 0x28
cmp eax, 0x56
je 0x1003bcef
cmp eax, 0x10
je 0x1003bcef
cmp eax, 3
jne 0x1003bd04
push str.isXferPacket_MySetRegUserStr_clear2
push 0
call fcn.1004122a
pop ecx
pop ecx
jmp 0x1003bd04
mov ebx, 0x104
lea eax, [ebp + 0x3964]
push eax
push dword [ebp - 0x48]
call fcn.10037e4e
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
pop ecx
pop ecx
mov edi, 0x100610d8
push edi
push 0
call esi
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x1003bd5b
push edi
push eax
call esi
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x1003bd5b
xor esi, esi
push esi
push str.tc_hnd
push str.SOFTWARE_trueEPTC_Env_tc_COMMUNICATION
mov edi, reloc.WS2_32.dll_bind
push edi
call fcn.10040c17
add esp, 0x10
mov dword [ebp - 0x40], eax
cmp eax, esi
je 0x1003bd76
jmp 0x1003bd62
mov edi, reloc.WS2_32.dll_bind
xor esi, esi
push dword [ebp - 0x64]
push dword [ebp - 0x50]
push 0xc98
push dword [ebp - 0x40]
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x1015568c], esi
je 0x1003bd9a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x3764]
push eax
push dword [ebp - 0x40]
push str.SendInfoDisplay_File_0x_08x___s___s_
push esi
call fcn.1004122a
add esp, 0x14
cmp dword [0x1015568c], 0x11
mov byte [0x102b4a44], 0
jne 0x1003bdbf
mov eax, dword [ebp - 0x2c]
and eax, 1
push eax
push str.SendInfoDisplay_flag__SEND_CUT__d_
push esi
call fcn.1004122a
add esp, 0xc
test dword [0x1015686c], 0x20000000
je 0x1003bdfd
cmp dword [ebp - 0x2c], 0x11
je 0x1003bdd7
cmp dword [ebp - 0x2c], 0x21
jne 0x1003bdfd
cmp dword [0x101570ac], esi
jne 0x1003bde8
cmp byte [0x10151cd8], 0
je 0x1003bdfd
lea eax, [ebp - 0x50]
push eax
push esi
push esi
push fcn.10016334
push esi
push esi
call fcn.1004547d
add esp, 0x18
cmp dword [0x101570c0], esi
jne 0x1003be12
cmp byte [0x100a1c18], 0
je 0x1003c036
push ebx
lea eax, [ebp + 0x4260]
push esi
push eax
call fcn.10044b80
push ebx
lea eax, [ebp + 0x4460]
push esi
push eax
call fcn.10044b80
mov esi, 0x208
push esi
lea eax, [ebp + 0x335c]
push 0
push eax
call fcn.10044b80
push ebx
lea eax, [ebp + 0x4060]
push 0
push eax
call fcn.10044b80
push 0x10154c28
lea eax, [ebp + 0x4060]
push str._s_D
push eax
call fcn.10044ec8
push esi
lea eax, [ebp + 0x335c]
push eax
lea eax, [ebp + 0x4060]
push eax
mov esi, str.SoftWare_trueEP_tc_MultiX
push esi
push edi
call fcn.1004171d
add esp, 0x50
cmp byte [0x100a1c18], 0
lea eax, [ebp + 0x335c]
mov dword [ebp - 0x30], eax
je 0x1003be9e
mov dword [ebp - 0x30], 0x100a1c18
cmp dword [0x1015568c], 0
je 0x1003beb9
push dword [ebp - 0x30]
push str.SendInfoDisplay_sTC_Chrome_D__s_
push 0
call fcn.1004122a
add esp, 0xc
mov eax, dword [ebp - 0x30]
cmp byte [eax], 0
je 0x1003bfd7
mov ebx, dword [ebp - 0x58]
cmp byte [ebx + 1], 0x3a
jne 0x1003bf13
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003bef0
lea edx, [ebp + 0x4260]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003bee4
jmp 0x1003bf27
push 0x5c
push ebx
call fcn.10047230
pop ecx
pop ecx
test eax, eax
je 0x1003bf27
inc eax
lea edx, [ebp + 0x4260]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003bf07
jmp 0x1003bf27
lea edx, [ebp + 0x4260]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003bf1d
lea eax, [ebp + 0x4260]
push eax
push dword [ebp - 0x30]
call fcn.1004c1f9
pop ecx
pop ecx
test eax, eax
jne 0x1003bf55
cmp byte [0x100a1c18], al
je 0x1003bf4e
mov byte [0x100a1c18], al
jmp 0x1003bfd7
push 0x10060ec9
jmp 0x1003bfc6
lea eax, [ebp + 0x4260]
push eax
lea eax, [ebp + 0x4460]
push str.__s_
push eax
call fcn.10044ec8
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x4460]
mov byte [ebp + eax + 0x4260], cl
inc eax
test cl, cl
jne 0x1003bf72
lea eax, [ebp + 0x4260]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003bfd7
lea ecx, [ebp + 0x4260]
lea ebx, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1003bfa2
sub ecx, ebx
add ecx, eax
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x1003bfb1
cmp byte [0x100a1c18], al
jne 0x1003bfd7
push dword [ebp - 0x30]
lea eax, [ebp + 0x4060]
push eax
push esi
push edi
call fcn.10042219
add esp, 0x10
xor ebx, ebx
cmp dword [0x1015568c], ebx
je 0x1003bff2
push dword [ebp - 0x30]
push str.SendInfoDisplay_sTC_Chrome_D_End__s_
push ebx
call fcn.1004122a
add esp, 0xc
cmp dword [0x101570c0], ebx
je 0x1003c034
mov ebx, 0x10154c28
push ebx
lea eax, [ebp + 0x4460]
push str._s_D
push eax
call fcn.10044ec8
push 0x10060ec9
push ebx
push esi
push edi
call fcn.10042219
push 0x10060ec9
lea eax, [ebp + 0x4460]
push eax
push esi
push edi
call fcn.10042219
add esp, 0x2c
xor esi, esi
cmp byte [0x101570e7], 0
je 0x1003c061
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
call edi
push eax
call dword [0x10186978]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2c]
and eax, 1
mov ecx, dword [ebp + 0x4764]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x4768
leave
ret 0x1c