Function at 0x10002b50
Capabilities:
Create thread
Get hostname
Hide graphical window

Disassembly:
sub esp, 0x214
mov eax, dword [esp + 0x218]
mov ecx, dword [esp + 0x220]
push ebx
mov ebx, dword [esp + 0x228]
push esi
push edi
mov edi, dword [esp + 0x24c]
mov dword [0x1000e3b4], eax
mov dword [0x1000e3e0], ecx
or ecx, 0xffffffff
xor eax, eax
mov dword [0x1000e3b0], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x120]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0xc], 0x28
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x250]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x228]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x248]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x240]
mov edi, dword [esp + 0x244]
mov dword [0x1000d47c], ecx
mov dword [0x1000d474], eax
or ecx, 0xffffffff
xor eax, eax
mov dword [0x1000e2a8], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.221.142.244.144
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp edx, 0x3c
rep movsb byte es:[edi], byte [esi]
jge 0x10002c36
mov dword [0x1000e2a8], 0x3c
mov esi, 0x1000c5f4
lea eax, [esp + 0x20]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10002c63
test cl, cl
je 0x10002c5f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10002c63
add eax, 2
add esi, 2
test cl, cl
jne 0x10002c3f
xor eax, eax
jmp 0x10002c68
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10002cb1
mov esi, 0x1000c5dc
lea eax, [esp + 0x120]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10002c9c
test cl, cl
je 0x10002c98
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10002c9c
add eax, 2
add esi, 2
test cl, cl
jne 0x10002c78
xor eax, eax
jmp 0x10002ca1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10002cb1
mov dword [0x1000c600], 0x1ac8
jmp 0x10002d0a
mov edi, 0x1000c5d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x1000e2a8], 0x3c
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x120]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.test_smartysoft.com
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x23c]
push 0x1000c5bc
push esi
call fcn.10008cc0
add esp, 8
test eax, eax
je 0x10002d82
push 0x1000c5b8
push esi
call fcn.10008cc0
add esp, 8
test eax, eax
je 0x10002d82
push 0x1000c5b4
push esi
call fcn.10008cc0
add esp, 8
test eax, eax
je 0x10002d82
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp eax, 0xc04
jg 0x10002d72
je 0x10002e7f
cmp eax, 0x404
je 0x10002e7f
cmp eax, 0x804
jne 0x10002f66
jmp 0x10002d98
cmp eax, 0x1004
jne 0x10002f66
jmp 0x10002e7f
push 0x1000c5bc
push esi
call fcn.10008cc0
add esp, 8
test eax, eax
jne 0x10002e69
mov esi, dword [0x1000d440]
push 0x1000c594
push 0x1000e8e8
call esi
push 0x1000c588
push 0x1000e6e8
call esi
push str.S_MR
push str.OffLine_Now
call esi
push 0x1000c564
push 0x1000e3e4
call esi
push 0x1000c550
push str.Proxy_Server_Disabled
call esi
push str.http:__www.smartysoft.cn_softonline
push str.http:__www.smartysoft.com_softonline
call esi
push str.support_smartysoft.cn
push 0x1000dd90
call esi
mov edi, 0x1000c4c8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e190
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.www.smartysoft.cn
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4a0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e090
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c5bc
jmp 0x10003032
push 0x1000c5b8
push esi
call fcn.10008cc0
add esp, 8
test eax, eax
jne 0x10002f50
mov esi, dword [0x1000d440]
push 0x1000c480
push 0x1000e8e8
call esi
push 0x1000c474
push 0x1000e6e8
call esi
push str.vuMR
push str.OffLine_Now
call esi
push 0x1000c450
push 0x1000e3e4
call esi
push 0x1000c43c
push str.Proxy_Server_Disabled
call esi
push str.http:__www.smartysoft.net_softonline
push str.http:__www.smartysoft.com_softonline
call esi
push str.support_smartysoft.net
push 0x1000dd90
call esi
mov edi, 0x1000c4b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e190
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.www.smartysoft.cn
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4a0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e090
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c5b8
jmp 0x10003032
push 0x1000c5b4
push esi
call fcn.10008cc0
add esp, 8
test eax, eax
jne 0x10003052
mov esi, dword [0x1000d440]
push 0x1000c3a0
push 0x1000e8e8
call esi
push 0x1000c388
push 0x1000e6e8
call esi
push 0x1000c370
push str.OffLine_Now
call esi
push 0x1000c348
push 0x1000e3e4
call esi
push 0x1000c31c
push str.Proxy_Server_Disabled
call esi
push 0x1000c2d0
push str.http:__www.smartysoft.com_softonline
call esi
push 0x1000c2a0
push 0x1000dd90
call esi
mov edi, 0x1000c4a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e190
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.www.smartysoft.cn
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e090
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c5b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x1000e290
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10002220
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.hostscan
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x120]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x1000e5e4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x1000e3b8
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, dword [0x1000e3b4]
mov eax, dword [0x1000d468]
push edx
push eax
call fcn.100039c0
mov ecx, dword [0x1000e3b4]
add esp, 8
mov dword [0x1000d988], eax
push 0x10003820
push 0xfffffffffffffffc
push ecx
call dword [0x1000d460]
mov dword [0x1000eae8], eax
mov eax, dword [0x1000e3b4]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x234]
cmp esi, 0xa0
jge 0x10003108
mov esi, 0xa0
mov ecx, dword [esp + 0x238]
mov dword [0x1000e2a4], esi
cmp ecx, 0x28
jge 0x1000311f
mov ecx, 0x28
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test edi, edi
mov dword [0x1000d984], ecx
jne 0x10003135
test eax, eax
je 0x100031a7
cmp ebx, 1
jne 0x1000314a
push ebx
push ecx
mov ecx, dword [0x1000d988]
push esi
push 0
push 0
push ecx
jmp 0x100031a1
cmp ebx, 2
jne 0x1000315a
push 1
push ecx
push esi
sub edi, esi
push 0
push edi
jmp 0x1000319a
cmp ebx, 3
jne 0x10003170
push 1
push ecx
sub eax, ecx
push esi
push eax
mov eax, dword [0x1000d988]
push 0
push eax
jmp 0x100031a1
push 1
cmp ebx, 4
push ecx
push esi
jne 0x10003188
sub eax, ecx
mov ecx, dword [0x1000d988]
sub edi, esi
push eax
push edi
push ecx
jmp 0x100031a1
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, edi
sub eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
mov edx, dword [0x1000d988]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [0x1000d988]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x1000d468]
push 0x1000d580
push 0
push ecx
push 0x100031f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [0x1000d478], eax
pop esi
mov eax, 0xa
pop ebx
add esp, 0x214
ret