Function at 0x10033860
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51e4
call fcn.1003e9a0
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x51dc], ecx
cmp dword [0x101213a0], 0
je 0x1003388e
xor eax, eax
jmp 0x10034424
push str.FTPD_
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100338a8
xor eax, eax
jmp 0x10034424
movzx ecx, byte [0x10120f85]
test ecx, ecx
je 0x100338db
cmp dword [ebp + 8], 8
je 0x100338db
push str.Explorer.exe
call fcn.10033740
add esp, 4
cmp eax, 1
jne 0x100338db
cmp dword [0x1026cc2c], 0
jne 0x100338db
xor eax, eax
jmp 0x10034424
mov edx, dword [ebp + 8]
and edx, 0x100
je 0x100339bf
cmp dword [0x1026cc2c], 0
jne 0x100339bf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101213a4]
mov dword [ebp - 0x4bd0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101213a4]
jmp 0x1003392e
cmp dword [0x101213a0], 0
je 0x10033943
cmp dword [ebp - 0x4bd0], 0x2710
jb 0x10033958
cmp dword [0x101213a0], 0
jne 0x100339bf
cmp dword [ebp - 0x4bd0], 0x7d0
jae 0x100339bf
cmp dword [0x101213a0], 0
je 0x10033972
mov eax, dword [0x101213a4]
sub eax, 0xbb8
mov dword [0x101213a4], eax
jmp 0x10033984
mov ecx, dword [0x101213a4]
sub ecx, 0x2710
mov dword [0x101213a4], ecx
cmp dword [0x1011fd7c], 0x88
je 0x100339a2
cmp dword [0x1011fd7c], 0x44
je 0x100339a2
cmp dword [0x1011fd7c], 4
jne 0x100339b8
mov edx, dword [ebp - 0x4bd0]
push edx
push str.SendInfoDisplayRansom_cancel__d_
push 0
call fcn.1003b7a0
add esp, 0xc
xor eax, eax
jmp 0x10034424
mov eax, dword [ebp + 0x10]
or eax, 0x400
mov dword [ebp - 0x47c4], eax
cmp dword [0x1011fd7c], 0x88
je 0x100339eb
cmp dword [0x1011fd7c], 0x44
je 0x100339eb
cmp dword [0x1011fd7c], 4
jne 0x10033a10
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [0x10120b64]
push edx
mov eax, dword [ebp - 0x47c4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.SendInfoDisplayRansom_0__08x__08x__08x__s
push 0
call fcn.1003b7a0
add esp, 0x18
mov edx, dword [ebp + 0x10]
and edx, 1
jne 0x10033a45
push 0x1005f5d0
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033a45
push 0x1005f5d8
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10033a45
xor eax, eax
jmp 0x10034424
cmp dword [0x1011fd7c], 0x88
je 0x10033a5a
cmp dword [0x1011fd7c], 0x44
jne 0x10033a7e
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [0x10120b64]
push eax
mov ecx, dword [ebp - 0x47c4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.SendInfoDisplayRansom_1__08x__08x__08x__s
push 0
call fcn.1003b7a0
add esp, 0x18
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4bcc], eax
cmp dword [0x10120b60], 2
jne 0x10033aa5
mov ecx, dword [ebp - 0x47c4]
and ecx, 1
je 0x10033aa5
mov dword [ebp - 0x47c4], 0x42
mov edx, dword [ebp - 0x47c4]
and edx, 1
je 0x10033ad9
movsx eax, byte [0x101257e0]
test eax, eax
je 0x10033ad9
push 0x1011f518
push 0x101257e0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033ad9
mov dword [ebp - 0x47c4], 0x42
mov ecx, dword [ebp - 0x47c4]
or ecx, 0x400
mov dword [ebp - 0x47c4], ecx
mov byte [ebp - 0x49c8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x49c7]
push edx
call fcn.1003e4c0
add esp, 0xc
mov eax, dword [ebp + 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10033c0b
mov edx, dword [ebp + 0x14]
push edx
call fcn.1003e420
add esp, 4
cmp eax, 0x200
jae 0x10033c0b
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x49c8]
push ecx
call fcn.10008420
add esp, 8
lea edx, [ebp - 0x49c8]
push edx
call fcn.1003e8b9
add esp, 4
movsx eax, byte [0x10074310]
test eax, eax
je 0x10033be3
push 0x10074310
lea ecx, [ebp - 0x49c8]
push ecx
call fcn.10008370
add esp, 8
test eax, eax
je 0x10033be3
mov esi, dword [0x10074714]
add esi, 0xbb8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, eax
jbe 0x10033be3
cmp dword [0x1011fd7c], 0x88
jne 0x10033bb2
lea edx, [ebp - 0x49c8]
push edx
mov eax, dword [ebp + 0x18]
push eax
push str.SendInfoDisplayRansom_dup___d___s
push 0
call fcn.1003b7a0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10074714], eax
mov ecx, dword [ebp - 0x47c4]
and ecx, 1
je 0x10033bd5
mov edx, dword [ebp + 8]
and edx, 4
je 0x10033bd5
call fcn.1000fe20
mov eax, dword [ebp - 0x47c4]
and eax, 1
jmp 0x10034424
lea eax, [ebp - 0x49c8]
push eax
push 0x10074310
call fcn.10008420
add esp, 8
mov ecx, dword [ebp + 0x18]
mov dword [0x10074710], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10074714], eax
mov byte [ebp - 0x1da8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x1da7]
push edx
call fcn.1003e4c0
add esp, 0xc
mov eax, dword [0x1011c7d4]
add eax, 0xea60
push eax
push 0x1005f62c
lea ecx, [ebp - 0x1da8]
push ecx
call fcn.1003e91e
add esp, 0xc
mov byte [ebp - 0x4bc8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x4bc7]
push edx
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x1ba0], 0
push 0x1ff
push 0
lea eax, [ebp - 0x1b9f]
push eax
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x1590], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x158f]
push ecx
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x1390], 0
push 0x1387
push 0
lea edx, [ebp - 0x138f]
push edx
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x47b8], 0
push 0x13ff
push 0
lea eax, [ebp - 0x47b7]
push eax
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x31a8], 0
push 0x13ff
push 0
lea ecx, [ebp - 0x31a7]
push ecx
call fcn.1003e4c0
add esp, 0xc
mov eax, dword [0x10261c18]
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
mov dword [ebp - 0x31b8], edx
mov edx, dword [0x10261c18]
add edx, 1
mov dword [0x10261c18], edx
push 0x1005e742
lea eax, [ebp - 0x4bc8]
push eax
call fcn.1003e91e
add esp, 8
mov ecx, dword [ebp - 0x31b8]
push ecx
push 0x1005f630
lea edx, [ebp - 0x1590]
push edx
call fcn.1003e91e
add esp, 0xc
lea eax, [ebp - 0x1ba0]
push eax
call fcn.1003b350
add esp, 4
mov ecx, dword [ebp - 0x47c4]
mov dword [ebp - 0x31b4], ecx
mov byte [ebp - 0x33b8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x33b7]
push edx
call fcn.1003e4c0
add esp, 0xc
lea eax, [ebp - 0x31b0]
push eax
call fcn.10034460
add esp, 4
lea ecx, [ebp - 0x31b0]
push ecx
call fcn.10034440
add esp, 4
mov dword [ebp - 0x1ba4], eax
cmp dword [ebp - 0x1ba4], 0
je 0x10033dd0
mov edx, dword [ebp - 0x1ba4]
push edx
push 0x1005f634
push 0x200
lea eax, [ebp - 0x33b8]
push eax
call fcn.1003f453
add esp, 0x10
jmp 0x10033de4
push 0x1005f648
lea ecx, [ebp - 0x33b8]
push ecx
call fcn.10008420
add esp, 8
mov byte [ebp - 0x19a0], 0
push 0x400
push 0
lea edx, [ebp - 0x199f]
push edx
call fcn.1003e4c0
add esp, 0xc
mov eax, dword [0x100676a4]
and eax, 0x2000
je 0x10033e2b
cmp dword [ebp + 0x1c], 0
je 0x10033e2b
push 0x200
lea ecx, [ebp - 0x19a0]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.1003bdf0
add esp, 0xc
mov byte [ebp - 0x47c0], 0
xor eax, eax
mov dword [ebp - 0x47bf], eax
mov ecx, dword [ebp + 8]
and ecx, 8
je 0x10033e58
push str.L__
lea edx, [ebp - 0x47c0]
push edx
call fcn.1003fd60
add esp, 8
jmp 0x10033eb5
mov eax, dword [ebp + 8]
and eax, 0x100
je 0x10033e78
push str.O__
lea ecx, [ebp - 0x47c0]
push ecx
call fcn.1003fd60
add esp, 8
jmp 0x10033eb5
mov edx, dword [ebp + 8]
and edx, 0x200
je 0x10033e99
push str.D__
lea eax, [ebp - 0x47c0]
push eax
call fcn.1003fd60
add esp, 8
jmp 0x10033eb5
mov ecx, dword [ebp + 8]
and ecx, 4
je 0x10033eb5
push str.B__
lea edx, [ebp - 0x47c0]
push edx
call fcn.1003fd60
add esp, 8
mov eax, dword [ebp - 0x47c4]
and eax, 1
je 0x10034120
mov ecx, dword [0x100676ac]
and ecx, 2
je 0x10034120
push 0x1400
push 0
lea edx, [ebp - 0x47b8]
push edx
call fcn.1003e4c0
add esp, 0xc
push 0x1400
lea eax, [ebp - 0x47b8]
push eax
call fcn.1002fa30
add esp, 8
cmp dword [0x1011fd7c], 0x88
je 0x10033f12
cmp dword [0x1011fd7c], 0x44
jne 0x10033f21
push str.GetDLLStacks_end
push 0
call fcn.1003b7a0
add esp, 8
movsx ecx, byte [ebp - 0x47b8]
test ecx, ecx
je 0x10033f5d
push str.createsoftwareinventory
lea edx, [ebp - 0x47b8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033f5d
push str.SYSTEM32_rundll32.EXE
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10033f5d
xor eax, eax
jmp 0x10034424
cmp dword [0x1011fd7c], 0x88
je 0x10033f72
cmp dword [0x1011fd7c], 0x44
jne 0x10033f81
push str.SendInfoDisplayRansom_disp_6
push 0
call fcn.1003b7a0
add esp, 8
mov byte [ebp - 0x4dd0], 0
push 0x1ff
push 0
lea eax, [ebp - 0x4dcf]
push eax
call fcn.1003e4c0
add esp, 0xc
lea ecx, [ebp - 0x4dd0]
push ecx
lea edx, [ebp - 0x1ba0]
push edx
call fcn.1003e030
add esp, 8
cmp dword [0x1011fd7c], 0x88
je 0x10033fc9
cmp dword [0x1011fd7c], 0x44
jne 0x10033fd8
push str.SendInfoDisplayRansom_disp_66
push 0
call fcn.1003b7a0
add esp, 8
push 0x1005f6f4
lea eax, [ebp - 0x1ba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003401e
push 0x1005f704
lea ecx, [ebp - 0x1ba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003401e
push 0x1005f710
lea edx, [ebp - 0x1ba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100340ba
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x51d8]
push eax
call fcn.1003fd60
add esp, 8
push 0x20
lea ecx, [ebp - 0x51d8]
push ecx
call fcn.10003a50
add esp, 8
mov dword [ebp - 0x4dd4], eax
cmp dword [ebp - 0x4dd4], 0
jne 0x10034062
lea edx, [ebp - 0x51d8]
mov dword [ebp - 0x4dd4], edx
jmp 0x10034071
mov eax, dword [ebp - 0x4dd4]
add eax, 1
mov dword [ebp - 0x4dd4], eax
lea ecx, [ebp - 0x47b8]
push ecx
mov edx, dword [ebp - 0x4dd4]
push edx
lea eax, [ebp - 0x4dd0]
push eax
lea ecx, [ebp - 0x1ba0]
push ecx
call fcn.10008180
add esp, 4
push eax
lea edx, [ebp - 0x1ba0]
push edx
lea eax, [ebp - 0x47c0]
push eax
push str._s_s__d__s__s_0___s
lea ecx, [ebp - 0x31a8]
push ecx
call fcn.1003e91e
add esp, 0x20
jmp 0x100340fa
lea edx, [ebp - 0x47b8]
push edx
lea eax, [ebp - 0x4dd0]
push eax
lea ecx, [ebp - 0x1ba0]
push ecx
call fcn.10008180
add esp, 4
push eax
lea edx, [ebp - 0x1ba0]
push edx
lea eax, [ebp - 0x47c0]
push eax
push str._s_s__d__s__s
lea ecx, [ebp - 0x31a8]
push ecx
call fcn.1003e91e
add esp, 0x1c
cmp dword [0x1011fd7c], 0x88
je 0x1003410f
cmp dword [0x1011fd7c], 0x44
jne 0x1003411e
push str.SendInfoDisplayRansom_disp_666
push 0
call fcn.1003b7a0
add esp, 8
jmp 0x10034142
lea edx, [ebp - 0x1ba0]
push edx
lea eax, [ebp - 0x47c0]
push eax
push 0x1005f760
lea ecx, [ebp - 0x31a8]
push ecx
call fcn.1003e91e
add esp, 0x10
cmp dword [0x1011fd7c], 0x88
je 0x10034157
cmp dword [0x1011fd7c], 0x44
jne 0x1003416d
lea edx, [ebp - 0x31a8]
push edx
push str._tSendInfoDisplayRansom_:__s
push 0
call fcn.1003b7a0
add esp, 0xc
lea eax, [ebp - 0x31a8]
push eax
call fcn.1003e420
add esp, 4
cmp eax, 0x1400
jbe 0x1003418a
mov byte [ebp - 0x1da9], 0
mov ecx, dword [0x100676a4]
and ecx, 0x2000
je 0x100341ac
cmp dword [ebp + 0x1c], 0
je 0x100341ac
lea edx, [ebp - 0x19a0]
mov dword [ebp - 0x51e0], edx
jmp 0x100341b6
mov dword [ebp - 0x51e0], 0x1005e743
cmp dword [ebp + 0x20], 0
je 0x100341c7
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x51e4], eax
jmp 0x100341d6
mov ecx, dword [ebp - 0x51dc]
add ecx, 0x58
mov dword [ebp - 0x51e4], ecx
mov edx, dword [ebp - 0x51e0]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x51dc]
mov edx, dword [ecx + 0x8b2c]
push edx
mov eax, dword [ebp - 0x51e4]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x4bcc]
push edx
lea eax, [ebp - 0x31a8]
push eax
mov ecx, dword [ebp - 0x31b4]
push ecx
lea edx, [ebp - 0x33b8]
push edx
push 0x1005f784
lea eax, [ebp - 0x1390]
push eax
call fcn.1003e91e
add esp, 0x2c
mov ecx, dword [ebp - 0x4bcc]
push ecx
call fcn.1003e420
add esp, 4
test eax, eax
ja 0x10034243
xor eax, eax
jmp 0x10034424
lea edx, [ebp - 0x1390]
push edx
lea eax, [ebp - 0x1590]
push eax
lea ecx, [ebp - 0x4bc8]
push ecx
push reloc.WS2_32.dll_bind
call fcn.1003dbc0
add esp, 0x10
cmp dword [0x1011fd7c], 0x88
je 0x1003427a
cmp dword [0x1011fd7c], 0x44
jne 0x1003429e
lea edx, [ebp - 0x1390]
push edx
lea eax, [ebp - 0x1590]
push eax
lea ecx, [ebp - 0x4bc8]
push ecx
push str.SendInfoDisplayRansom_disp_sKey_:__s_sVal_:__s_sData_:__s
push 0
call fcn.1003b7a0
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x1005f7dc
push 0x1005e74a
push reloc.WS2_32.dll_bind
call fcn.1003d360
add esp, 0x10
cmp dword [0x1011fd7c], 0x11
je 0x100342ce
cmp dword [0x1011fd7c], 0x44
jne 0x100342e4
lea edx, [ebp - 0x1390]
push edx
push str.SendInfoDisplayRansom__s_
push 0
call fcn.1003b7a0
add esp, 0xc
lea eax, [ebp - 0x33b8]
push eax
mov ecx, dword [ebp - 0x4bcc]
push ecx
call fcn.10033360
add esp, 8
push 0x1005e74b
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
jne 0x10034329
push 0x1005e771
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
jne 0x10034351
push 0
push 0x1005f800
push 0x1005e772
push reloc.WS2_32.dll_bind
call fcn.1003d040
add esp, 0x10
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
je 0x1003437a
mov edx, dword [ebp - 0x31b4]
push edx
mov eax, dword [ebp - 0x31b8]
push eax
push 0xc98
mov ecx, dword [ebp - 0x1594]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x1011fd7c], 0x88
jne 0x100343a3
mov edx, dword [ebp - 0x31b4]
push edx
mov eax, dword [ebp - 0x31b8]
push eax
push str.SendInfoDisplayRansom_disp_WPARAM_:__d_LPARAM_:__d
push 0
call fcn.1003b7a0
add esp, 0x10
mov byte [0x10261ba6], 0
cmp dword [0x1011fd7c], 0x11
jne 0x100343cc
mov ecx, dword [ebp - 0x47c4]
and ecx, 1
push ecx
push str.SendInfoDisplayRansom_flag__SEND_CUT__d_
push 0
call fcn.1003b7a0
add esp, 0xc
cmp dword [0x1011fd7c], 0x88
je 0x100343e1
cmp dword [0x1011fd7c], 0x44
jne 0x100343f0
push str.SendInfoDisplayRansom_End
push 0
call fcn.1003b7a0
add esp, 8
mov edx, dword [ebp - 0x47c4]
and edx, 1
je 0x1003441b
mov eax, dword [ebp + 8]
and eax, 4
je 0x1003441b
cmp dword [ebp + 0xc], 0x80000000
jne 0x1003441b
mov dword [0x1011cc24], 0x63
call fcn.1000fe20
mov eax, dword [ebp - 0x47c4]
and eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret 0x1c