Function at 0x1003e16d
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2d98]
mov eax, 0x2e18
call fcn.10044f70
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x2d94], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x70], ecx
cmp dword [ebp + 0x2dac], ebx
jne 0x1003e1a1
xor eax, eax
jmp 0x1003e6d7
push esi
mov esi, str.messenger
cmp byte [esi], bl
je 0x1003e352
cmp esi, str.IsPass_9
jae 0x1003e352
push esi
push 0x10153168
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1003e34f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003e1d5
sub eax, edx
lea esi, [esi + eax + 1]
cmp esi, ebx
jne 0x1003e1a7
cmp dword [0x10156874], 2
mov eax, dword [ebp + 0x2da0]
push 0x48
mov dword [ebp - 0x74], eax
pop esi
je 0x1003e204
test byte [0x1014f5fc], 1
je 0x1003e207
mov dword [ebp - 0x74], esi
test byte [ebp - 0x74], 1
je 0x1003e22c
cmp byte [0x1015bb48], bl
je 0x1003e22c
push 0x10154a28
push 0x1015bb48
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003e22c
mov dword [ebp - 0x74], esi
cmp dword [0x1015568c], 0x64
jne 0x1003e258
push dword [ebp + 0x2dac]
push dword [ebp + 0x2da8]
push dword [ebp + 0x2da4]
push dword [ebp - 0x74]
push str.SendInfoDisplay:_d:_d:_d:_d
push ebx
call fcn.1004122a
add esp, 0x18
push edi
mov esi, 0x1ff
push esi
lea eax, [ebp + 0x2595]
push ebx
push eax
mov byte [ebp + 0x2594], bl
call fcn.10044b80
push esi
lea eax, [ebp + 0x2795]
push ebx
push eax
mov byte [ebp + 0x2794], bl
call fcn.10044b80
push 0xdff
lea eax, [ebp + 0x995]
push ebx
push eax
mov byte [ebp + 0x994], bl
call fcn.10044b80
mov edi, 0x9ff
push edi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.10044b80
push edi
lea eax, [ebp + 0x1b95]
push ebx
push eax
mov byte [ebp + 0x1b94], bl
call fcn.10044b80
mov eax, dword [0x102b4a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x2594]
push str.SoftWare_trueEP_td_DDXP
push eax
mov edi, edx
add edi, 0x64
inc dword [0x102b4a40]
mov dword [ebp - 0x78], edi
call fcn.10044ec8
add esp, 0x44
push edi
lea eax, [ebp + 0x2794]
push 0x10061178
push eax
call fcn.10044ec8
push esi
lea eax, [ebp + 0x2b95]
push ebx
push eax
mov byte [ebp + 0x2b94], bl
call fcn.10044b80
lea eax, [ebp - 0x80]
push eax
call fcn.1004532b
lea eax, [ebp - 0x80]
push eax
call fcn.10045304
add esp, 0x20
cmp eax, ebx
je 0x1003e362
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x2b94]
push 0x200
push eax
call fcn.10045fb5
add esp, 0x10
jmp 0x1003e375
or esi, 0xffffffff
cmp esi, 0xffffffff
jne 0x1003e1e6
xor eax, eax
jmp 0x1003e6d6
lea eax, [ebp + 0x2b94]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
test byte [0x10077cc8], 2
je 0x1003e48d
lea eax, [ebp - 0x6c]
push 0xa00
push eax
call fcn.1003372f
push esi
lea eax, [ebp + 0x2995]
push ebx
push eax
mov byte [ebp + 0x2994], bl
call fcn.10044b80
mov esi, dword [ebp - 0x70]
lea eax, [ebp + 0x2994]
push eax
add esi, 0x78c
push esi
call fcn.10040d71
add esp, 0x1c
cmp byte [0x102b4630], bl
je 0x1003e3d8
mov eax, 0x102b4630
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003e3ce
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.rundll32.exe
push esi
call edi
test eax, eax
jne 0x1003e42f
push str.dllhost.exe
push esi
call edi
test eax, eax
jne 0x1003e42f
push str.svchost.exe
push esi
call edi
test eax, eax
jne 0x1003e42f
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2994]
push eax
push esi
call fcn.1000770a
pop ecx
push eax
push esi
lea eax, [ebp + 0x1b94]
push str._s__d__s__s
push eax
call fcn.10044ec8
add esp, 0x18
jmp 0x1003e4cc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp + 0x1794]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x1003e43b
lea eax, [ebp + 0x1794]
push 0x20
push eax
call fcn.10044a60
pop ecx
pop ecx
cmp eax, ebx
jne 0x1003e461
lea eax, [ebp + 0x1794]
jmp 0x1003e462
inc eax
lea ecx, [ebp - 0x6c]
push ecx
push eax
lea eax, [ebp + 0x2994]
push eax
push esi
call fcn.1000770a
pop ecx
push eax
push esi
lea eax, [ebp + 0x1b94]
push str._s__d__s__s_0___s
push eax
call fcn.10044ec8
add esp, 0x1c
jmp 0x1003e4cc
cmp byte [0x102b4630], bl
je 0x1003e4af
mov edx, dword [ebp - 0x70]
mov eax, 0x102b4630
add edx, 0x78c
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003e4a5
mov eax, dword [ebp - 0x70]
add eax, 0x78c
push eax
lea eax, [ebp + 0x1b94]
push eax
call fcn.1000789a
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
pop ecx
pop ecx
push str._fdrv_
lea eax, [ebp + 0x1b94]
push eax
call edi
test eax, eax
jne 0x1003e656
test byte [0x10150868], 1
mov eax, dword [ebp - 0x70]
lea ecx, [eax + 0x580]
je 0x1003e53f
push 0x1014d918
push dword [eax + 0x780]
add eax, 0x380
push ecx
push eax
lea eax, [ebp + 0x1b94]
push eax
lea eax, [ebp + 0x2b94]
push eax
push dword [ebp + 0x2dac]
lea eax, [ebp + 0x994]
push dword [ebp + 0x2da8]
push dword [ebp + 0x2da4]
push dword [ebp - 0x74]
push str._d_d_d_d_s_s_s_s_d_s
push eax
call fcn.10044ec8
add esp, 0x30
jmp 0x1003e583
push dword [eax + 0x780]
add eax, 0x380
push ecx
push eax
lea eax, [ebp + 0x1b94]
push eax
lea eax, [ebp + 0x2b94]
push eax
push dword [ebp + 0x2dac]
lea eax, [ebp + 0x994]
push dword [ebp + 0x2da8]
push dword [ebp + 0x2da4]
push dword [ebp - 0x74]
push str._d_d_d_d_s_s_s_s_d
push eax
call fcn.10044ec8
add esp, 0x2c
lea eax, [ebp + 0x994]
push eax
lea eax, [ebp + 0x2794]
push eax
lea eax, [ebp + 0x2594]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.10042219
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARE_trueEP_tc_Env
push esi
call fcn.10041961
add esp, 0x10
cmp dword [0x1015568c], 0x64
jne 0x1003e5d6
push str.SendInfoDisplay_1
push ebx
call fcn.1004122a
pop ecx
pop ecx
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, 0x100610d8
push edi
push ebx
call esi
mov dword [ebp - 0x70], eax
cmp eax, ebx
jne 0x1003e616
push edi
push ebx
call esi
mov dword [ebp - 0x70], eax
cmp eax, ebx
jne 0x1003e616
push ebx
push str.tc_hnd
push str.SOFTWARE_trueEPTC_Env_tc_COMMUNICATION
push reloc.WS2_32.dll_bind
call fcn.10040c17
add esp, 0x10
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x1003e636
test byte [ebp - 0x74], 1
push ebx
push dword [ebp - 0x78]
push 0xd60
push dword [ebp - 0x70]
je 0x1003e630
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1003e636
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x1015568c], 0x64
jne 0x1003e650
push dword [ebp - 0x70]
push str.SendInfoDisplay_2__d
push ebx
call fcn.1004122a
add esp, 0xc
test byte [ebp - 0x74], 0x40
je 0x1003e65a
xor eax, eax
jmp 0x1003e6d5
cmp dword [0x10156884], 1
jne 0x1003e6d2
test byte [ebp - 0x74], 8
je 0x1003e6d2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1015568c], 0x64
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jne 0x1003e691
call esi
push eax
push str.ExitProcess___d_
push ebx
call fcn.1004122a
add esp, 0xc
cmp dword [0x102b4a3c], 5
jne 0x1003e6ad
cmp dword [0x10077cd8], 0x501
jl 0x1003e6ad
call fcn.1001632b
jmp 0x1003e6d2
test byte [0x102d2d98], 2
je 0x1003e6be
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call esi
push eax
call dword [0x10186978]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp + 0x2d94]
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x2d98
leave
ret 0x10