Function at 0x10043f00
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x10044380
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10043f27
sub eax, edx
sar eax, 1
cmp eax, 3
jb 0x10044380
push 0x2e
push 0
push ebx
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x10044380
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push str..btc
push ebx
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
call esi
test eax, eax
jne 0x10043f81
push ebx
call fcn.10005080
test al, al
je 0x10043f81
mov eax, 0x6d
jmp 0x10044382
mov eax, ebx
call fcn.1000efe0
test al, al
je 0x10043f96
mov eax, 0x6c
jmp 0x10044382
push 0xfe
lea eax, [esp + 0x16]
push 0
push eax
call fcn.100d4cc0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.100073f0
test al, al
je 0x10043fc4
mov eax, 0x6b
jmp 0x10044382
mov eax, ebx
call fcn.1001a980
test al, al
je 0x10043fd9
mov eax, 0x6a
jmp 0x10044382
mov eax, ebx
call fcn.1000ea20
test al, al
je 0x10043fee
mov eax, 0x69
jmp 0x10044382
push ebx
call ebp
push str..QQ1766834247
push eax
call esi
test eax, eax
jne 0x10044011
push ebx
call fcn.10010830
test eax, eax
je 0x10044011
mov eax, 0x68
jmp 0x10044382
cmp dword [0x101e06b4], 0
je 0x1004402f
mov ecx, ebx
call fcn.1001ea80
test eax, eax
je 0x1004402f
mov eax, 0x67
jmp 0x10044382
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x10128764
call esi
push ebx
mov edi, eax
call esi
push eax
push edi
call fcn.10005bd0
test eax, eax
je 0x10044056
mov eax, 0x66
jmp 0x10044382
mov ecx, ebx
call fcn.10007da0
test al, al
je 0x1004406b
mov eax, 0x65
jmp 0x10044382
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
push edi
call esi
cmp eax, 0x38
jle 0x10044092
push ebx
mov eax, edi
call fcn.1000a340
test al, al
je 0x10044092
mov eax, 0x64
jmp 0x10044382
call fcn.10009460
test eax, eax
je 0x100440a5
mov eax, 0x63
jmp 0x10044382
mov ecx, ebx
mov eax, 0x101e2b88
call fcn.10003a80
test eax, eax
je 0x100440bf
mov eax, 0x62
jmp 0x10044382
push ebx
call fcn.10014930
test al, al
je 0x100440d3
mov eax, 0x61
jmp 0x10044382
mov edi, ebx
call fcn.1001b260
test al, al
je 0x100440e8
mov eax, 0x5c
jmp 0x10044382
push ebx
call fcn.100066a0
test al, al
je 0x100440fc
mov eax, 0x60
jmp 0x10044382
mov eax, ebx
call fcn.100085f0
test al, al
je 0x10044111
mov eax, 0x5f
jmp 0x10044382
mov ecx, ebx
call fcn.1000a520
test eax, eax
je 0x10044126
mov eax, 0x5e
jmp 0x10044382
mov eax, ebx
call fcn.10004930
test al, al
je 0x1004413b
mov eax, 0x5d
jmp 0x10044382
mov eax, ebx
call fcn.1001b1d0
test al, al
je 0x10044150
mov eax, 0x5b
jmp 0x10044382
push ebx
call fcn.1001aca0
test al, al
je 0x10044164
mov eax, 0x5a
jmp 0x10044382
mov eax, ebx
call fcn.1000dd60
test al, al
je 0x10044179
mov eax, 0x59
jmp 0x10044382
mov eax, ebx
call fcn.1001da90
test al, al
je 0x1004418e
mov eax, 0x58
jmp 0x10044382
call fcn.1000b7e0
test al, al
je 0x100441a1
mov eax, 0x57
jmp 0x10044382
push ebx
call ebp
test eax, eax
je 0x100441c2
push str..ransomcrypt
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100441c2
mov eax, 0x56
jmp 0x10044382
mov ecx, ebx
call fcn.10048580
test eax, eax
je 0x100441d7
mov eax, 0x42
jmp 0x10044382
mov eax, ebx
call fcn.10004ce0
test al, al
je 0x100441ec
mov eax, 0x54
jmp 0x10044382
mov ecx, ebx
call fcn.1001dc60
test al, al
je 0x10044201
mov eax, 0x55
jmp 0x10044382
mov eax, ebx
call fcn.1000b460
test al, al
je 0x10044216
mov eax, 0x53
jmp 0x10044382
mov eax, ebx
call fcn.100196e0
test eax, eax
jne 0x1004422b
mov eax, 0x40
jmp 0x10044382
mov ecx, ebx
call fcn.100198a0
test eax, eax
je 0x10044240
mov eax, 0x41
jmp 0x10044382
mov eax, ebx
call fcn.10004570
test al, al
je 0x10044255
mov eax, 0x4f
jmp 0x10044382
mov ecx, ebx
call fcn.10004150
test al, al
je 0x1004426a
mov eax, 0x52
jmp 0x10044382
push ebx
call fcn.10018240
test eax, eax
je 0x1004427e
mov eax, 0x43
jmp 0x10044382
push ebx
call fcn.1002a9d0
test eax, eax
je 0x10044292
mov eax, 0x46
jmp 0x10044382
mov ecx, ebx
call fcn.10029100
test eax, eax
je 0x100442a7
mov eax, 0x45
jmp 0x10044382
call fcn.10029230
test eax, eax
jne 0x1004429d
mov ecx, ebx
call fcn.1002c1a0
test eax, eax
je 0x100442c5
mov eax, 0x47
jmp 0x10044382
call fcn.1003e9e0
test eax, eax
je 0x100442d8
mov eax, 0x48
jmp 0x10044382
mov eax, ebx
call fcn.1000a2d0
test eax, eax
je 0x100442ed
mov eax, 0x49
jmp 0x10044382
push ebx
call fcn.10005870
test eax, eax
je 0x10044301
mov eax, 0x4b
jmp 0x10044382
mov eax, ebx
call fcn.10010ca0
test al, al
je 0x10044313
mov eax, 0x4e
jmp 0x10044382
mov eax, ebx
call fcn.1001f850
test al, al
je 0x10044325
mov eax, 0x4c
jmp 0x10044382
mov eax, ebx
call fcn.1001fa10
test al, al
je 0x10044337
mov eax, 0x4d
jmp 0x10044382
mov eax, ebx
call fcn.1000b140
test al, al
je 0x10044349
mov eax, 0x50
jmp 0x10044382
mov eax, ebx
call fcn.1000f980
test al, al
je 0x1004435b
mov eax, 0x51
jmp 0x10044382
push ebx
call ebp
test eax, eax
je 0x10044379
push str..allcry
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10044379
mov eax, 0x4a
jmp 0x10044382
mov eax, 1
jmp 0x10044382
xor eax, eax
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x10c
ret