Function at 0x10033840
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51e4
call fcn.1003e980
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x51dc], ecx
cmp dword [0x101213a0], 0
je 0x1003386e
xor eax, eax
jmp 0x10034404
push str.FTPD_
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033888
xor eax, eax
jmp 0x10034404
movzx ecx, byte [0x10120f85]
test ecx, ecx
je 0x100338bb
cmp dword [ebp + 8], 8
je 0x100338bb
push str.Explorer.exe
call fcn.10033720
add esp, 4
cmp eax, 1
jne 0x100338bb
cmp dword [0x1026cc2c], 0
jne 0x100338bb
xor eax, eax
jmp 0x10034404
mov edx, dword [ebp + 8]
and edx, 0x100
je 0x1003399f
cmp dword [0x1026cc2c], 0
jne 0x1003399f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101213a4]
mov dword [ebp - 0x4bd0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101213a4]
jmp 0x1003390e
cmp dword [0x101213a0], 0
je 0x10033923
cmp dword [ebp - 0x4bd0], 0x2710
jb 0x10033938
cmp dword [0x101213a0], 0
jne 0x1003399f
cmp dword [ebp - 0x4bd0], 0x7d0
jae 0x1003399f
cmp dword [0x101213a0], 0
je 0x10033952
mov eax, dword [0x101213a4]
sub eax, 0xbb8
mov dword [0x101213a4], eax
jmp 0x10033964
mov ecx, dword [0x101213a4]
sub ecx, 0x2710
mov dword [0x101213a4], ecx
cmp dword [0x1011fd7c], 0x88
je 0x10033982
cmp dword [0x1011fd7c], 0x44
je 0x10033982
cmp dword [0x1011fd7c], 4
jne 0x10033998
mov edx, dword [ebp - 0x4bd0]
push edx
push str.SendInfoDisplayRansom_cancel__d_
push 0
call fcn.1003b780
add esp, 0xc
xor eax, eax
jmp 0x10034404
mov eax, dword [ebp + 0x10]
or eax, 0x400
mov dword [ebp - 0x47c4], eax
cmp dword [0x1011fd7c], 0x88
je 0x100339cb
cmp dword [0x1011fd7c], 0x44
je 0x100339cb
cmp dword [0x1011fd7c], 4
jne 0x100339f0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [0x10120b64]
push edx
mov eax, dword [ebp - 0x47c4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SendInfoDisplayRansom_0__08x__08x__08x__s
push 0
call fcn.1003b780
add esp, 0x18
mov edx, dword [ebp + 0x10]
and edx, 1
jne 0x10033a25
push 0x1005f5d0
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033a25
push 0x1005f5d8
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10033a25
xor eax, eax
jmp 0x10034404
cmp dword [0x1011fd7c], 0x88
je 0x10033a3a
cmp dword [0x1011fd7c], 0x44
jne 0x10033a5e
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [0x10120b64]
push eax
mov ecx, dword [ebp - 0x47c4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.SendInfoDisplayRansom_1__08x__08x__08x__s
push 0
call fcn.1003b780
add esp, 0x18
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4bcc], eax
cmp dword [0x10120b60], 2
jne 0x10033a85
mov ecx, dword [ebp - 0x47c4]
and ecx, 1
je 0x10033a85
mov dword [ebp - 0x47c4], 0x42
mov edx, dword [ebp - 0x47c4]
and edx, 1
je 0x10033ab9
movsx eax, byte [0x101257e0]
test eax, eax
je 0x10033ab9
push 0x1011f518
push 0x101257e0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033ab9
mov dword [ebp - 0x47c4], 0x42
mov ecx, dword [ebp - 0x47c4]
or ecx, 0x400
mov dword [ebp - 0x47c4], ecx
mov byte [ebp - 0x49c8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x49c7]
push edx
call fcn.1003e4a0
add esp, 0xc
mov eax, dword [ebp + 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10033beb
mov edx, dword [ebp + 0x14]
push edx
call fcn.1003e400
add esp, 4
cmp eax, 0x200
jae 0x10033beb
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x49c8]
push ecx
call fcn.10008420
add esp, 8
lea edx, [ebp - 0x49c8]
push edx
call fcn.1003e899
add esp, 4
movsx eax, byte [0x10074310]
test eax, eax
je 0x10033bc3
push 0x10074310
lea ecx, [ebp - 0x49c8]
push ecx
call fcn.10008370
add esp, 8
test eax, eax
je 0x10033bc3
mov esi, dword [0x10074714]
add esi, 0xbb8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, eax
jbe 0x10033bc3
cmp dword [0x1011fd7c], 0x88
jne 0x10033b92
lea edx, [ebp - 0x49c8]
push edx
mov eax, dword [ebp + 0x18]
push eax
push str.SendInfoDisplayRansom_dup___d___s
push 0
call fcn.1003b780
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10074714], eax
mov ecx, dword [ebp - 0x47c4]
and ecx, 1
je 0x10033bb5
mov edx, dword [ebp + 8]
and edx, 4
je 0x10033bb5
call fcn.1000fe20
mov eax, dword [ebp - 0x47c4]
and eax, 1
jmp 0x10034404
lea eax, [ebp - 0x49c8]
push eax
push 0x10074310
call fcn.10008420
add esp, 8
mov ecx, dword [ebp + 0x18]
mov dword [0x10074710], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10074714], eax
mov byte [ebp - 0x1da8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x1da7]
push edx
call fcn.1003e4a0
add esp, 0xc
mov eax, dword [0x1011c7d4]
add eax, 0xea60
push eax
push 0x1005f62c
lea ecx, [ebp - 0x1da8]
push ecx
call fcn.1003e8fe
add esp, 0xc
mov byte [ebp - 0x4bc8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x4bc7]
push edx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x1ba0], 0
push 0x1ff
push 0
lea eax, [ebp - 0x1b9f]
push eax
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x1590], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x158f]
push ecx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x1390], 0
push 0x1387
push 0
lea edx, [ebp - 0x138f]
push edx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x47b8], 0
push 0x13ff
push 0
lea eax, [ebp - 0x47b7]
push eax
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x31a8], 0
push 0x13ff
push 0
lea ecx, [ebp - 0x31a7]
push ecx
call fcn.1003e4a0
add esp, 0xc
mov eax, dword [0x10261c18]
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
mov dword [ebp - 0x31b8], edx
mov edx, dword [0x10261c18]
add edx, 1
mov dword [0x10261c18], edx
push 0x1005e742
lea eax, [ebp - 0x4bc8]
push eax
call fcn.1003e8fe
add esp, 8
mov ecx, dword [ebp - 0x31b8]
push ecx
push 0x1005f630
lea edx, [ebp - 0x1590]
push edx
call fcn.1003e8fe
add esp, 0xc
lea eax, [ebp - 0x1ba0]
push eax
call fcn.1003b330
add esp, 4
mov ecx, dword [ebp - 0x47c4]
mov dword [ebp - 0x31b4], ecx
mov byte [ebp - 0x33b8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x33b7]
push edx
call fcn.1003e4a0
add esp, 0xc
lea eax, [ebp - 0x31b0]
push eax
call fcn.10034440
add esp, 4
lea ecx, [ebp - 0x31b0]
push ecx
call fcn.10034420
add esp, 4
mov dword [ebp - 0x1ba4], eax
cmp dword [ebp - 0x1ba4], 0
je 0x10033db0
mov edx, dword [ebp - 0x1ba4]
push edx
push 0x1005f634
push 0x200
lea eax, [ebp - 0x33b8]
push eax
call fcn.1003f433
add esp, 0x10
jmp 0x10033dc4
push 0x1005f648
lea ecx, [ebp - 0x33b8]
push ecx
call fcn.10008420
add esp, 8
mov byte [ebp - 0x19a0], 0
push 0x400
push 0
lea edx, [ebp - 0x199f]
push edx
call fcn.1003e4a0
add esp, 0xc
mov eax, dword [0x100676a4]
and eax, 0x2000
je 0x10033e0b
cmp dword [ebp + 0x1c], 0
je 0x10033e0b
push 0x200
lea ecx, [ebp - 0x19a0]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.1003bdd0
add esp, 0xc
mov byte [ebp - 0x47c0], 0
xor eax, eax
mov dword [ebp - 0x47bf], eax
mov ecx, dword [ebp + 8]
and ecx, 8
je 0x10033e38
push str.L__
lea edx, [ebp - 0x47c0]
push edx
call fcn.1003fd40
add esp, 8
jmp 0x10033e95
mov eax, dword [ebp + 8]
and eax, 0x100
je 0x10033e58
push str.O__
lea ecx, [ebp - 0x47c0]
push ecx
call fcn.1003fd40
add esp, 8
jmp 0x10033e95
mov edx, dword [ebp + 8]
and edx, 0x200
je 0x10033e79
push str.D__
lea eax, [ebp - 0x47c0]
push eax
call fcn.1003fd40
add esp, 8
jmp 0x10033e95
mov ecx, dword [ebp + 8]
and ecx, 4
je 0x10033e95
push str.B__
lea edx, [ebp - 0x47c0]
push edx
call fcn.1003fd40
add esp, 8
mov eax, dword [ebp - 0x47c4]
and eax, 1
je 0x10034100
mov ecx, dword [0x100676ac]
and ecx, 2
je 0x10034100
push 0x1400
push 0
lea edx, [ebp - 0x47b8]
push edx
call fcn.1003e4a0
add esp, 0xc
push 0x1400
lea eax, [ebp - 0x47b8]
push eax
call fcn.1002fa10
add esp, 8
cmp dword [0x1011fd7c], 0x88
je 0x10033ef2
cmp dword [0x1011fd7c], 0x44
jne 0x10033f01
push str.GetDLLStacks_end
push 0
call fcn.1003b780
add esp, 8
movsx ecx, byte [ebp - 0x47b8]
test ecx, ecx
je 0x10033f3d
push str.createsoftwareinventory
lea edx, [ebp - 0x47b8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033f3d
push str.SYSTEM32_rundll32.EXE
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033f3d
xor eax, eax
jmp 0x10034404
cmp dword [0x1011fd7c], 0x88
je 0x10033f52
cmp dword [0x1011fd7c], 0x44
jne 0x10033f61
push str.SendInfoDisplayRansom_disp_6
push 0
call fcn.1003b780
add esp, 8
mov byte [ebp - 0x4dd0], 0
push 0x1ff
push 0
lea eax, [ebp - 0x4dcf]
push eax
call fcn.1003e4a0
add esp, 0xc
lea ecx, [ebp - 0x4dd0]
push ecx
lea edx, [ebp - 0x1ba0]
push edx
call fcn.1003e010
add esp, 8
cmp dword [0x1011fd7c], 0x88
je 0x10033fa9
cmp dword [0x1011fd7c], 0x44
jne 0x10033fb8
push str.SendInfoDisplayRansom_disp_66
push 0
call fcn.1003b780
add esp, 8
push 0x1005f6f4
lea eax, [ebp - 0x1ba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10033ffe
push 0x1005f704
lea ecx, [ebp - 0x1ba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10033ffe
push 0x1005f710
lea edx, [ebp - 0x1ba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003409a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x51d8]
push eax
call fcn.1003fd40
add esp, 8
push 0x20
lea ecx, [ebp - 0x51d8]
push ecx
call fcn.10003a50
add esp, 8
mov dword [ebp - 0x4dd4], eax
cmp dword [ebp - 0x4dd4], 0
jne 0x10034042
lea edx, [ebp - 0x51d8]
mov dword [ebp - 0x4dd4], edx
jmp 0x10034051
mov eax, dword [ebp - 0x4dd4]
add eax, 1
mov dword [ebp - 0x4dd4], eax
lea ecx, [ebp - 0x47b8]
push ecx
mov edx, dword [ebp - 0x4dd4]
push edx
lea eax, [ebp - 0x4dd0]
push eax
lea ecx, [ebp - 0x1ba0]
push ecx
call fcn.10008180
add esp, 4
push eax
lea edx, [ebp - 0x1ba0]
push edx
lea eax, [ebp - 0x47c0]
push eax
push str._s_s__d__s__s_0___s
lea ecx, [ebp - 0x31a8]
push ecx
call fcn.1003e8fe
add esp, 0x20
jmp 0x100340da
lea edx, [ebp - 0x47b8]
push edx
lea eax, [ebp - 0x4dd0]
push eax
lea ecx, [ebp - 0x1ba0]
push ecx
call fcn.10008180
add esp, 4
push eax
lea edx, [ebp - 0x1ba0]
push edx
lea eax, [ebp - 0x47c0]
push eax
push str._s_s__d__s__s
lea ecx, [ebp - 0x31a8]
push ecx
call fcn.1003e8fe
add esp, 0x1c
cmp dword [0x1011fd7c], 0x88
je 0x100340ef
cmp dword [0x1011fd7c], 0x44
jne 0x100340fe
push str.SendInfoDisplayRansom_disp_666
push 0
call fcn.1003b780
add esp, 8
jmp 0x10034122
lea edx, [ebp - 0x1ba0]
push edx
lea eax, [ebp - 0x47c0]
push eax
push 0x1005f760
lea ecx, [ebp - 0x31a8]
push ecx
call fcn.1003e8fe
add esp, 0x10
cmp dword [0x1011fd7c], 0x88
je 0x10034137
cmp dword [0x1011fd7c], 0x44
jne 0x1003414d
lea edx, [ebp - 0x31a8]
push edx
push str._tSendInfoDisplayRansom_:__s
push 0
call fcn.1003b780
add esp, 0xc
lea eax, [ebp - 0x31a8]
push eax
call fcn.1003e400
add esp, 4
cmp eax, 0x1400
jbe 0x1003416a
mov byte [ebp - 0x1da9], 0
mov ecx, dword [0x100676a4]
and ecx, 0x2000
je 0x1003418c
cmp dword [ebp + 0x1c], 0
je 0x1003418c
lea edx, [ebp - 0x19a0]
mov dword [ebp - 0x51e0], edx
jmp 0x10034196
mov dword [ebp - 0x51e0], 0x1005e743
cmp dword [ebp + 0x20], 0
je 0x100341a7
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x51e4], eax
jmp 0x100341b6
mov ecx, dword [ebp - 0x51dc]
add ecx, 0x58
mov dword [ebp - 0x51e4], ecx
mov edx, dword [ebp - 0x51e0]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x51dc]
mov edx, dword [ecx + 0x8b2c]
push edx
mov eax, dword [ebp - 0x51e4]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x4bcc]
push edx
lea eax, [ebp - 0x31a8]
push eax
mov ecx, dword [ebp - 0x31b4]
push ecx
lea edx, [ebp - 0x33b8]
push edx
push 0x1005f784
lea eax, [ebp - 0x1390]
push eax
call fcn.1003e8fe
add esp, 0x2c
mov ecx, dword [ebp - 0x4bcc]
push ecx
call fcn.1003e400
add esp, 4
test eax, eax
ja 0x10034223
xor eax, eax
jmp 0x10034404
lea edx, [ebp - 0x1390]
push edx
lea eax, [ebp - 0x1590]
push eax
lea ecx, [ebp - 0x4bc8]
push ecx
push reloc.WS2_32.dll_bind
call fcn.1003dba0
add esp, 0x10
cmp dword [0x1011fd7c], 0x88
je 0x1003425a
cmp dword [0x1011fd7c], 0x44
jne 0x1003427e
lea edx, [ebp - 0x1390]
push edx
lea eax, [ebp - 0x1590]
push eax
lea ecx, [ebp - 0x4bc8]
push ecx
push str.SendInfoDisplayRansom_disp_sKey_:__s_sVal_:__s_sData_:__s
push 0
call fcn.1003b780
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x1005f7dc
push 0x1005e74a
push reloc.WS2_32.dll_bind
call fcn.1003d340
add esp, 0x10
cmp dword [0x1011fd7c], 0x11
je 0x100342ae
cmp dword [0x1011fd7c], 0x44
jne 0x100342c4
lea edx, [ebp - 0x1390]
push edx
push str.SendInfoDisplayRansom__s_
push 0
call fcn.1003b780
add esp, 0xc
lea eax, [ebp - 0x33b8]
push eax
mov ecx, dword [ebp - 0x4bcc]
push ecx
call fcn.10033340
add esp, 8
push 0x1005e74b
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
jne 0x10034309
push 0x1005e771
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
jne 0x10034331
push 0
push 0x1005f800
push 0x1005e772
push reloc.WS2_32.dll_bind
call fcn.1003d020
add esp, 0x10
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
je 0x1003435a
mov edx, dword [ebp - 0x31b4]
push edx
mov eax, dword [ebp - 0x31b8]
push eax
push 0xc98
mov ecx, dword [ebp - 0x1594]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x1011fd7c], 0x88
jne 0x10034383
mov edx, dword [ebp - 0x31b4]
push edx
mov eax, dword [ebp - 0x31b8]
push eax
push str.SendInfoDisplayRansom_disp_WPARAM_:__d_LPARAM_:__d
push 0
call fcn.1003b780
add esp, 0x10
mov byte [0x10261ba6], 0
cmp dword [0x1011fd7c], 0x11
jne 0x100343ac
mov ecx, dword [ebp - 0x47c4]
and ecx, 1
push ecx
push str.SendInfoDisplayRansom_flag__SEND_CUT__d_
push 0
call fcn.1003b780
add esp, 0xc
cmp dword [0x1011fd7c], 0x88
je 0x100343c1
cmp dword [0x1011fd7c], 0x44
jne 0x100343d0
push str.SendInfoDisplayRansom_End
push 0
call fcn.1003b780
add esp, 8
mov edx, dword [ebp - 0x47c4]
and edx, 1
je 0x100343fb
mov eax, dword [ebp + 8]
and eax, 4
je 0x100343fb
cmp dword [ebp + 0xc], 0x80000000
jne 0x100343fb
mov dword [0x1011cc24], 0x63
call fcn.1000fe20
mov eax, dword [ebp - 0x47c4]
and eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret 0x1c