Function at 0x10038ff0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2e2c
call fcn.1003e980
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2e2c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1a20], eax
cmp dword [0x10120b60], 2
jne 0x10039029
mov dword [ebp - 0x1a20], 0x48
mov ecx, dword [ebp - 0x1a20]
and ecx, 1
je 0x1003905d
movsx edx, byte [0x101257e0]
test edx, edx
je 0x1003905d
push 0x1011f518
push 0x101257e0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003905d
mov dword [ebp - 0x1a20], 0x48
cmp dword [0x1011fd7c], 0x64
jne 0x10039088
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1a20]
push eax
push str.SendInfoDisplay:_d:_d:_d:_d
push 0
call fcn.1003b780
add esp, 0x18
mov byte [ebp - 0x2820], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x281f]
push ecx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x1008], 0
push 0x1ff
push 0
lea edx, [ebp - 0x1007]
push edx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0xe08], 0
push 0xdff
push 0
lea eax, [ebp - 0xe07]
push eax
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x2620], 0
push 0x9ff
push 0
lea ecx, [ebp - 0x261f]
push ecx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x1a10], 0
push 0x9ff
push 0
lea edx, [ebp - 0x1a0f]
push edx
call fcn.1003e4a0
add esp, 0xc
mov eax, dword [0x10261c18]
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
mov dword [ebp - 0x1a1c], edx
mov edx, dword [0x10261c18]
add edx, 1
mov dword [0x10261c18], edx
push 0x1006011a
lea eax, [ebp - 0x2820]
push eax
call fcn.1003e8fe
add esp, 8
mov ecx, dword [ebp - 0x1a1c]
push ecx
push 0x1006050c
lea edx, [ebp - 0x1008]
push edx
call fcn.1003e8fe
add esp, 0xc
mov byte [ebp - 0x1c20], 0
push 0x1ff
push 0
lea eax, [ebp - 0x1c1f]
push eax
call fcn.1003e4a0
add esp, 0xc
lea ecx, [ebp - 0x1a18]
push ecx
call fcn.100395c0
add esp, 4
lea edx, [ebp - 0x1a18]
push edx
call fcn.100395a0
add esp, 4
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0
je 0x100391d9
mov eax, dword [ebp - 0x1010]
push eax
push 0x10060510
push 0x200
lea ecx, [ebp - 0x1c20]
push ecx
call fcn.1003f433
add esp, 0x10
jmp 0x100391ed
push 0x10060524
lea edx, [ebp - 0x1c20]
push edx
call fcn.10008420
add esp, 8
mov eax, dword [0x100676ac]
and eax, 2
je 0x10039385
push 0xa00
lea ecx, [ebp - 0x2620]
push ecx
call fcn.1002fa10
add esp, 8
mov byte [ebp - 0x2a20], 0
push 0x1ff
push 0
lea edx, [ebp - 0x2a1f]
push edx
call fcn.1003e4a0
add esp, 0xc
lea eax, [ebp - 0x2a20]
push eax
mov ecx, dword [ebp - 0x2e2c]
add ecx, 0x78c
push ecx
call fcn.1003e010
add esp, 8
push str.rundll32.exe
mov edx, dword [ebp - 0x2e2c]
add edx, 0x78c
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003929f
push str.dllhost.exe
mov eax, dword [ebp - 0x2e2c]
add eax, 0x78c
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003929f
push str.svchost.exe
mov ecx, dword [ebp - 0x2e2c]
add ecx, 0x78c
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003933f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea edx, [ebp - 0x2e28]
push edx
call fcn.1003fd40
add esp, 8
push 0x20
lea eax, [ebp - 0x2e28]
push eax
call fcn.10003a50
add esp, 8
mov dword [ebp - 0x2a24], eax
cmp dword [ebp - 0x2a24], 0
jne 0x100392e3
lea ecx, [ebp - 0x2e28]
mov dword [ebp - 0x2a24], ecx
jmp 0x100392f2
mov edx, dword [ebp - 0x2a24]
add edx, 1
mov dword [ebp - 0x2a24], edx
lea eax, [ebp - 0x2620]
push eax
mov ecx, dword [ebp - 0x2a24]
push ecx
lea edx, [ebp - 0x2a20]
push edx
mov eax, dword [ebp - 0x2e2c]
add eax, 0x78c
push eax
call fcn.10008180
add esp, 4
push eax
mov ecx, dword [ebp - 0x2e2c]
add ecx, 0x78c
push ecx
push str._s__d__s__s_0___s
lea edx, [ebp - 0x1a10]
push edx
call fcn.1003e8fe
add esp, 0x1c
jmp 0x10039383
lea eax, [ebp - 0x2620]
push eax
lea ecx, [ebp - 0x2a20]
push ecx
mov edx, dword [ebp - 0x2e2c]
add edx, 0x78c
push edx
call fcn.10008180
add esp, 4
push eax
mov eax, dword [ebp - 0x2e2c]
add eax, 0x78c
push eax
push str._s__d__s__s
lea ecx, [ebp - 0x1a10]
push ecx
call fcn.1003e8fe
add esp, 0x18
jmp 0x100393a1
mov edx, dword [ebp - 0x2e2c]
add edx, 0x78c
push edx
lea eax, [ebp - 0x1a10]
push eax
call fcn.10008420
add esp, 8
mov ecx, dword [ebp - 0x2e2c]
mov edx, dword [ecx + 0x780]
push edx
mov eax, dword [ebp - 0x2e2c]
add eax, 0x580
push eax
mov ecx, dword [ebp - 0x2e2c]
add ecx, 0x380
push ecx
lea edx, [ebp - 0x1a10]
push edx
lea eax, [ebp - 0x1c20]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1a20]
push ecx
push str._d_d_d_d_s_s_s_s_d
lea edx, [ebp - 0xe08]
push edx
call fcn.1003e8fe
add esp, 0x2c
lea eax, [ebp - 0xe08]
push eax
lea ecx, [ebp - 0x1008]
push ecx
lea edx, [ebp - 0x2820]
push edx
push reloc.WS2_32.dll_bind
call fcn.1003dba0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x10060590
push 0x1006011b
push reloc.WS2_32.dll_bind
call fcn.1003d340
add esp, 0x10
cmp dword [0x1011fd7c], 0x64
jne 0x10039454
push str.SendInfoDisplay_1
push 0
call fcn.1003b780
add esp, 8
push 0x10060122
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
jne 0x10039483
push 0x10060123
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
jne 0x100394ab
push 0
push 0x100605ac
push 0x10060139
push reloc.WS2_32.dll_bind
call fcn.1003d020
add esp, 0x10
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x100394cf
push 0
mov eax, dword [ebp - 0x1a1c]
push eax
push 0xd60
mov ecx, dword [ebp - 0x100c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x1011fd7c], 0x64
jne 0x100394ee
mov edx, dword [ebp - 0x100c]
push edx
push str.SendInfoDisplay_2__d
push 0
call fcn.1003b780
add esp, 0xc
mov eax, dword [ebp - 0x1a20]
and eax, 0x40
je 0x10039505
xor eax, eax
jmp 0x1003958e
cmp dword [0x10120b6c], 1
jne 0x10039589
mov ecx, dword [ebp - 0x1a20]
and ecx, 8
je 0x10039589
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1011fd7c], 0x64
jne 0x10039540
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push str.ExitProcess___d_
push 0
call fcn.1003b780
add esp, 0xc
push str.SYSTEM32SVCHOST.EXE
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10039567
cmp dword [0x100676bc], 0x501
jl 0x10039567
call fcn.10019500
jmp 0x10039589
mov edx, dword [0x10280c5c]
and edx, 2
je 0x1003957a
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10176c60]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret 0x10