Function at 0x1000dd90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x100e1624], 4
jne 0x1000ddc4
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000ddc4
push 0x100361d0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000ddc4
mov eax, 1
jmp 0x1000e06b
cmp dword [ebp + 8], 0
jne 0x1000ddd1
xor eax, eax
jmp 0x1000e06b
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
jne 0x1000dde2
xor eax, eax
jmp 0x1000e06b
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x7e
jne 0x1000ddf4
xor eax, eax
jmp 0x1000e06b
push str..tmp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000de0e
xor eax, eax
jmp 0x1000e06b
mov ecx, dword [ebp + 8]
push ecx
call fcn.1001d4f0
add esp, 4
cmp eax, 4
ja 0x1000de26
xor eax, eax
jmp 0x1000e06b
push 0x100361e0
mov edx, dword [ebp + 8]
push edx
call fcn.1000b760
add esp, 8
test eax, eax
je 0x1000de42
xor eax, eax
jmp 0x1000e06b
push str.RECYCLE
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000de5c
xor eax, eax
jmp 0x1000e06b
push str._releasenotes.pdf
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000de76
xor eax, eax
jmp 0x1000e06b
push str._temp
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000de90
xor eax, eax
jmp 0x1000e06b
push str.pagefile.sys
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000deaa
xor eax, eax
jmp 0x1000e06b
mov ecx, dword [0x100dca64]
and ecx, 0x4000000
je 0x1000df8f
push str.PhysicalDrive
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1000defd
push str.DeviceHarddisk
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000df8f
push str.volumeshadowcopy
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1000df8f
push str.SVCHOST.EXE
push 0x100df7a0
call fcn.10003d90
add esp, 8
test eax, eax
jne 0x1000df6a
push 0x100e07d8
call fcn.1001d4f0
add esp, 4
push eax
push 0x100df3a0
push 0x100e07d8
call fcn.10003e00
add esp, 0xc
test eax, eax
jne 0x1000df6a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000df6a
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
test eax, eax
je 0x1000df6a
push str._k_localsystemnetworkrestricted
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000df6a
xor eax, eax
jmp 0x1000e06b
push str.Samsung
push 0x100df3a0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000df85
xor eax, eax
jmp 0x1000e06b
mov eax, 4
jmp 0x1000e06b
cmp dword [0x100d34e8], 0
je 0x1000dfbe
cmp dword [0x100d34e8], 0xffffffff
je 0x1000dfbe
mov edx, dword [ebp + 8]
push edx
call fcn.1000b810
add esp, 4
movzx eax, al
test eax, eax
je 0x1000dfbe
mov eax, 2
jmp 0x1000e06b
mov dword [ebp - 4], 0
push str..doc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e03d
push str..hwp
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e03d
push str..pdf
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e03d
push str..ppt
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e03d
push str..xls
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000e044
mov eax, 1
jmp 0x1000e06b
movsx eax, byte [0x100e00d8]
test eax, eax
je 0x1000e069
push 0x100e00d8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000e069
mov eax, 1
jmp 0x1000e06b
xor eax, eax
mov esp, ebp
pop ebp
ret