Function at 0x10013580
Capabilities:
Accept command line arguments
Create thread
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x49fc
call fcn.1001da70
mov eax, dword [0x1003e830]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0x49e8], ecx
cmp dword [0x100e0004], 0x88
je 0x100135bc
cmp dword [0x100e0004], 0x44
je 0x100135bc
cmp dword [0x100e0004], 2
jne 0x100135cf
mov eax, dword [ebp + 0x10]
push eax
push str.SendInfoDisplay_start:_s
push 0
call fcn.1001a870
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10012710
add esp, 4
movzx edx, al
test edx, edx
je 0x100135e9
xor eax, eax
jmp 0x100148f8
cmp dword [0x100e161c], 0
jne 0x10013605
push str._ahnlab
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013661
cmp dword [ebp + 0x14], 0x4c4b40
ja 0x10013621
push str..log
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001365a
push str.NzBrco.log
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001365a
push str.NzBrco32.log
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001365a
push str.accessibility.api
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013661
xor eax, eax
jmp 0x100148f8
mov byte [ebp - 1], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x37c8], edx
movzx eax, byte [0x100ded93]
test eax, eax
je 0x10013759
cmp dword [0x100e1214], 0
je 0x10013759
cmp dword [ebp + 0x18], 0
je 0x100136eb
cmp dword [ebp + 0x18], 0x99
je 0x100136eb
cmp dword [ebp + 0x1c], 0
je 0x100136e9
mov ecx, dword [ebp + 0x1c]
movsx edx, byte [ecx]
test edx, edx
je 0x100136e9
mov eax, dword [ebp + 0x1c]
push eax
call fcn.10003b40
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100136e9
mov dword [ebp - 0x37c8], 1
mov byte [ebp - 1], 1
cmp dword [0x100e0004], 0x88
jne 0x100136e9
mov edx, dword [ebp + 0x1c]
push edx
push str.SendInfoDisplay_PE_IE_cut_sDest:_s
push 0
call fcn.1001a870
add esp, 0xc
jmp 0x10013754
mov eax, dword [ebp - 0x49e8]
add eax, 0x58
push eax
call fcn.10003b40
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10013739
mov dword [ebp - 0x37c8], 1
mov byte [ebp - 1], 1
cmp dword [0x100e0004], 0x88
jne 0x10013737
mov edx, dword [ebp - 0x49e8]
add edx, 0x58
push edx
push str.SendInfoDisplay_PE_IE_cut_m_szIPAddress:_s
push 0
call fcn.1001a870
add esp, 0xc
jmp 0x10013754
cmp dword [0x100e0004], 0x88
jne 0x10013754
push str.SendInfoDisplay_PE_IE_OK
push 0
call fcn.1001a870
add esp, 8
jmp 0x100138b8
movzx eax, byte [0x100ded93]
test eax, eax
je 0x10013836
movzx ecx, byte [0x100e120d]
test ecx, ecx
je 0x10013836
movzx edx, byte [0x1005bfc0]
test edx, edx
je 0x1001378e
cmp dword [0x1003e548], 0x5b6a7988
jne 0x10013798
mov dword [ebp - 0x37c8], 1
mov byte [0x1005bfc0], 0
movsx eax, byte [0x1005c1d8]
test eax, eax
je 0x10013816
cmp dword [ebp + 0x18], 0
je 0x100137d8
cmp dword [ebp + 0x18], 0x99
je 0x100137d8
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.10003b30
add esp, 4
movzx edx, al
test edx, edx
je 0x100137d6
mov dword [ebp - 0x37c8], 1
jmp 0x100137fb
mov eax, dword [ebp - 0x49e8]
add eax, 0x58
push eax
call fcn.10003b30
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x100137fb
mov dword [ebp - 0x37c8], 1
cmp dword [0x100e0004], 0x88
jne 0x10013816
push str.SendInfoDisplay_disp
push 0
call fcn.1001a870
add esp, 8
cmp dword [0x100e0004], 0x88
jne 0x10013831
push str.SendInfoDisplay_g_tc_PE_IE__g_sbIsExplorer
push 0
call fcn.1001a870
add esp, 8
jmp 0x100138b8
mov edx, dword [ebp + 0xc]
and edx, 1
je 0x100138b8
cmp dword [ebp + 0x10], 0
je 0x100138b8
cmp dword [ebp + 0x18], 0
je 0x100138b8
push str..EXE
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.1001d4f0
add esp, 4
mov edx, dword [ebp + 0x10]
lea eax, [edx + eax - 4]
cmp esi, eax
je 0x1001389a
push str..DLL
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.1001d4f0
add esp, 4
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + eax - 4]
cmp esi, edx
jne 0x100138b8
mov eax, dword [ebp + 0x18]
movsx ecx, byte [eax]
cmp ecx, 0x4d
jne 0x100138b8
mov edx, dword [ebp + 0x18]
movsx eax, byte [edx + 1]
cmp eax, 0x5a
jne 0x100138b8
xor eax, eax
jmp 0x100148f8
cmp dword [0x100e0004], 0x88
je 0x100138d6
cmp dword [0x100e0004], 0x44
je 0x100138d6
cmp dword [0x100e0004], 2
jne 0x100138fb
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x100e0dec]
push edx
mov eax, dword [ebp - 0x37c8]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.SendInfoDisplay_0__08x__08x__08x__s
push 0
call fcn.1001a870
add esp, 0x18
mov edx, dword [ebp + 0xc]
and edx, 1
jne 0x10013930
push str.____
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013930
push 0x1003796c
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10013930
xor eax, eax
jmp 0x100148f8
cmp dword [0x100e0004], 0x88
je 0x1001394e
cmp dword [0x100e0004], 0x44
je 0x1001394e
cmp dword [0x100e0004], 2
jne 0x10013972
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [0x100e0dec]
push eax
mov ecx, dword [ebp - 0x37c8]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.SendInfoDisplay_1__08x__08x__08x__s
push 0
call fcn.1001a870
add esp, 0x18
mov dword [ebp - 0x2bbc], 0
mov eax, dword [ebp + 8]
and eax, 0x2000
je 0x100139de
cmp dword [0x100e161c], 3
jle 0x100139ad
mov dword [0x101c0868], 0
mov ecx, dword [0x100dca5c]
push ecx
push 0x10011dc0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x100139de
cmp dword [0x100e161c], 0
je 0x100139d4
mov dword [0x101c0868], 0
mov edx, dword [0x100dca5c]
push edx
push 0x10011ee0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x100139de
push 0
call fcn.10011d00
add esp, 4
movzx eax, byte [0x100e1633]
neg eax
sbb eax, eax
and eax, 0x2200
or eax, dword [0x101c0868]
or eax, 0x800
or eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [0x100e0004], 0x88
je 0x10013a1d
cmp dword [0x100e0004], 0x44
je 0x10013a1d
cmp dword [0x100e0004], 2
jne 0x10013a48
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [0x100e0de8]
push edx
mov eax, dword [0x100e0dec]
push eax
mov ecx, dword [ebp - 0x37c8]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.SendInfoDisplay_Out__08x__08x__08x__08x__s
push 0
call fcn.1001a870
add esp, 0x1c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3bd0], eax
mov byte [ebp - 0x2ba8], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x2ba7]
push ecx
call fcn.1001d590
add esp, 0xc
mov edx, dword [ebp + 8]
and edx, 0x4000000
jne 0x10013b2c
push 0x5c
mov eax, dword [ebp + 0x10]
push eax
call fcn.1001d620
add esp, 8
test eax, eax
jne 0x10013b2c
mov byte [ebp - 0x3dd0], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x3dcf]
push ecx
call fcn.1001d590
add esp, 0xc
lea edx, [ebp - 0x3dd0]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x3dd0]
push ecx
push 0x100379c0
lea edx, [ebp - 0x2ba8]
push edx
call fcn.1001d9ee
add esp, 0x10
push 0
lea eax, [ebp - 0x2ba8]
push eax
call fcn.10021228
add esp, 8
test eax, eax
je 0x10013b20
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, 0x10108348
call fcn.1000bec0
mov dword [ebp - 0x3bd0], eax
cmp dword [ebp - 0x3bd0], 0
je 0x10013b15
jmp 0x10013b1e
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3bd0], edx
jmp 0x10013b2c
lea eax, [ebp - 0x2ba8]
mov dword [ebp - 0x3bd0], eax
cmp dword [ebp + 0x14], 0
jne 0x10013b44
mov ecx, dword [ebp - 0x3bd0]
push ecx
call fcn.10003c80
add esp, 4
mov dword [ebp + 0x14], eax
mov dword [ebp - 0x37c4], 0
mov edx, dword [ebp + 8]
and edx, dword [0x100e0dec]
je 0x10013cf2
mov eax, dword [0x100f7684]
and eax, 0x200
je 0x10013b98
movsx ecx, byte [0x100f7e88]
test ecx, ecx
je 0x10013b98
movsx edx, byte [0x1004f6b0]
test edx, edx
je 0x10013b98
push 0x1004f6b0
push 0x100f7e88
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013b98
jmp 0x10013ced
mov eax, dword [0x100f7684]
and eax, 0x200
je 0x10013bd3
movsx ecx, byte [0x100dfda0]
test ecx, ecx
je 0x10013bd3
movsx edx, byte [0x100df7a0]
test edx, edx
je 0x10013bd3
push 0x100df7a0
push 0x100dfda0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013bd3
jmp 0x10013ced
mov eax, dword [ebp + 8]
and eax, 0x10000000
je 0x10013ca0
lea ecx, [ebp - 0x3fd0]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.100121d0
add esp, 8
movsx eax, byte [ebp - 0x3fd0]
test eax, eax
je 0x10013c1c
lea ecx, [ebp - 0x3fd0]
push ecx
push 0x101052f8
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013c1c
xor eax, eax
jmp 0x100148f8
mov edx, dword [0x100f7684]
and edx, 0x10000
je 0x10013c59
movsx eax, byte [ebp - 0x3fd0]
test eax, eax
je 0x10013c4d
lea ecx, [ebp - 0x3fd0]
push ecx
push 0x100f8088
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013c4d
jmp 0x10013c57
mov dword [ebp - 0x37c8], 0x11
jmp 0x10013c9e
mov edx, dword [0x100f7684]
and edx, 0x20000
je 0x10013c94
movsx eax, byte [ebp - 0x3fd0]
test eax, eax
je 0x10013c92
lea ecx, [ebp - 0x3fd0]
push ecx
push 0x100f8088
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013c92
mov dword [ebp - 0x37c8], 0x11
jmp 0x10013c9e
mov dword [ebp - 0x37c8], 0x11
jmp 0x10013ced
mov dword [ebp - 0x37c8], 0x11
cmp dword [0x100e0004], 0x11
jne 0x10013ced
push 0x100df7a0
push 0x100dfda0
push 0x1004f6b0
push 0x100f7e88
mov edx, dword [ebp + 0x10]
push edx
push 0x1004f6b0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [0x100e1638]
shl ecx, 0xa
push ecx
push str.SEND_CUTDEVICE3__08x____08x_host:__s__file:__s__g_tc_OKWebMail:__s__g_szMailFromHost:__s__g_tc_OKMsg:__s__g_szMyExeName:__s_
push 0
call fcn.1001a870
add esp, 0x28
jmp 0x10013d7b
cmp dword [ebp + 0x14], 0
je 0x10013d1d
mov edx, dword [0x100e1638]
shl edx, 0xa
cmp edx, dword [ebp + 0x14]
ja 0x10013d1d
mov eax, dword [0x100f7684]
and eax, 0x400
je 0x10013d1d
mov ecx, dword [ebp - 0x37c8]
and ecx, 2
jne 0x10013d42
mov edx, dword [0x100e1640]
shl edx, 0xa
cmp edx, dword [ebp + 0x14]
ja 0x10013d7b
mov eax, dword [0x100f7684]
and eax, 0x80000
je 0x10013d7b
mov ecx, dword [ebp + 8]
and ecx, 0x200
je 0x10013d7b
mov dword [ebp - 0x37c8], 0x21
cmp dword [0x100e0004], 0x11
jne 0x10013d7b
mov edx, dword [ebp + 0x10]
push edx
push 0x1004f6b0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [0x100e1638]
shl ecx, 0xa
push ecx
push str.SEND_CUTDEVICESIZE4__08x____08x_host:_s_file:_s
push 0
call fcn.1001a870
add esp, 0x18
mov edx, dword [ebp + 8]
and edx, dword [0x100e0dfc]
je 0x10013d9a
mov eax, dword [ebp + 8]
and eax, 0x4000000
je 0x10013d9a
mov dword [ebp - 0x37c8], 0x11
mov dword [ebp - 0x3bcc], 0
mov ecx, dword [0x100e0df0]
and ecx, 1
jne 0x10013ec0
cmp dword [ebp + 0x14], 0xa
jbe 0x10013ec0
mov byte [ebp - 0x41d8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x41d7]
push edx
call fcn.1001d590
add esp, 0xc
push str.TC_FLTR.exe
push 0x100df1a0
push str.__s_s_
lea eax, [ebp - 0x41d8]
push eax
call fcn.1001d9ee
add esp, 0x10
push str.Program_Files_
push 0x100df1a0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x3fd4], eax
mov ecx, dword [ebp - 0x3bd0]
push ecx
push str._r___s_
lea edx, [ebp - 0x43d8]
push edx
call fcn.1001d9ee
add esp, 0xc
cmp dword [0x100e0004], 0x91
jne 0x10013e52
lea eax, [ebp - 0x43d8]
push eax
lea ecx, [ebp - 0x41d8]
push ecx
push str._ShellExec_4_chk_PerInfo__s__sFName_s
push 0
call fcn.1001a870
add esp, 0x10
push 0
push 0x100df1a0
lea edx, [ebp - 0x43d8]
push edx
lea eax, [ebp - 0x41d8]
push eax
push str.open
push 0
push 0x1e
call fcn.1000b880
add esp, 0x1c
cmp eax, 0x3e7
jne 0x10013ec0
cmp dword [0x100e0004], 0x91
jne 0x10013ea1
mov ecx, dword [ebp - 0x3bd0]
push ecx
push str._Found_a_Personal_Infomation__s
push 0
call fcn.1001a870
add esp, 0xc
mov edx, dword [0x100e0dfc]
and edx, 1
je 0x10013eb6
mov dword [ebp - 0x37c8], 0x11
mov dword [ebp - 0x3bcc], 1
cmp dword [0x100e0de8], 2
je 0x10013ef1
movsx eax, byte [0x1012cdb8]
test eax, eax
je 0x10013f06
push 0x1012cdb8
call fcn.1001ad60
add esp, 4
push eax
push 0x100f7888
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013f06
mov ecx, dword [ebp - 0x37c8]
and ecx, 1
je 0x10013f06
mov dword [ebp - 0x37c8], 0x42
cmp dword [0x100e0de8], 2
je 0x10013f7e
cmp dword [ebp + 0x1c], 0
je 0x10013f2a
mov edx, dword [ebp + 0x1c]
movsx eax, byte [edx]
test eax, eax
je 0x10013f2a
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x49ec], ecx
jmp 0x10013f68
mov edx, dword [ebp - 0x49e8]
movsx eax, byte [edx + 0x58]
test eax, eax
je 0x10013f52
mov ecx, dword [ebp - 0x49e8]
add ecx, 0x58
push ecx
call fcn.1001ad60
add esp, 4
mov dword [ebp - 0x49f0], eax
jmp 0x10013f5c
mov dword [ebp - 0x49f0], 0x10037af8
mov edx, dword [ebp - 0x49f0]
mov dword [ebp - 0x49ec], edx
mov eax, dword [ebp - 0x49ec]
push eax
push 0x100f7888
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013f93
mov ecx, dword [ebp - 0x37c8]
and ecx, 1
je 0x10013f93
mov dword [ebp - 0x37c8], 0x42
mov edx, dword [ebp - 0x37c8]
and edx, 1
je 0x10013fc7
movsx eax, byte [0x100e5a68]
test eax, eax
je 0x10013fc7
push 0x100df7a0
push 0x100e5a68
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013fc7
mov dword [ebp - 0x37c8], 0x42
mov ecx, dword [ebp - 0x37c8]
and ecx, 1
je 0x10013ff9
mov edx, dword [ebp - 0x49e8]
mov byte [edx + 0x50bc], 1
mov eax, dword [ebp - 0x49e8]
mov byte [eax + 0x1470], 1
mov ecx, dword [ebp - 0x49e8]
mov byte [ecx + 0x630c], 1
mov byte [ebp - 0x39c8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x39c7]
push edx
call fcn.1001d590
add esp, 0xc
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10014151
mov edx, dword [ebp + 0x10]
push edx
call fcn.1001d4f0
add esp, 4
cmp eax, 0x200
jae 0x10014151
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x39c8]
push ecx
call fcn.10003f20
add esp, 8
lea edx, [ebp - 0x39c8]
push edx
call fcn.1001d989
add esp, 4
movsx eax, byte [0x1004add0]
test eax, eax
je 0x10014129
push 0x1004add0
lea ecx, [ebp - 0x39c8]
push ecx
call fcn.10003e70
add esp, 8
test eax, eax
je 0x10014129
mov edx, dword [0x1004b1d0]
cmp edx, dword [ebp + 0x14]
jne 0x10014129
mov eax, 4
test eax, eax
je 0x100140ac
mov dword [ebp - 0x49f4], 0xbb8
jmp 0x100140d4
push str..ISO
lea ecx, [ebp - 0x39c8]
push ecx
call fcn.10003e70
add esp, 8
neg eax
sbb eax, eax
and eax, 0x1194
add eax, 0x1f4
mov dword [ebp - 0x49f4], eax
mov esi, dword [0x1004b1d4]
add esi, dword [ebp - 0x49f4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, eax
jbe 0x10014129
cmp dword [0x100e0004], 0x88
jne 0x10014110
lea edx, [ebp - 0x39c8]
push edx
mov eax, dword [ebp + 0x14]
push eax
push str.SendInfoDisplay_dup___d___s
push 0
call fcn.1001a870
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1004b1d4], eax
mov eax, dword [ebp - 0x37c8]
and eax, 1
jmp 0x100148f8
lea ecx, [ebp - 0x39c8]
push ecx
push 0x1004add0
call fcn.10003f20
add esp, 8
mov edx, dword [ebp + 0x14]
mov dword [0x1004b1d0], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1004b1d4], eax
cmp dword [0x100e0004], 0x88
je 0x1001416f
cmp dword [0x100e0004], 0x44
je 0x1001416f
cmp dword [0x100e0004], 2
jne 0x1001417e
push str.SendInfoDisplay_disp_3
push 0
call fcn.1001a870
add esp, 8
mov byte [ebp - 0x1da8], 0
push 0x1ff
push 0
lea eax, [ebp - 0x1da7]
push eax
call fcn.1001d590
add esp, 0xc
mov ecx, dword [0x100dca5c]
add ecx, 0xea60
push ecx
push 0x10037b3c
lea edx, [ebp - 0x1da8]
push edx
call fcn.1001d9ee
add esp, 0xc
mov byte [ebp - 0x3bc8], 0
push 0x1ff
push 0
lea eax, [ebp - 0x3bc7]
push eax
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0x1ba0], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x1b9f]
push ecx
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0x1590], 0
push 0x1ff
push 0
lea edx, [ebp - 0x158f]
push edx
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0x1390], 0
push 0x1387
push 0
lea eax, [ebp - 0x138f]
push eax
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0x37c0], 0
push 0x9ff
push 0
lea ecx, [ebp - 0x37bf]
push ecx
call fcn.1001d590
add esp, 0xc
mov byte [ebp - 0x27a8], 0
push 0x9ff
push 0
lea edx, [ebp - 0x27a7]
push edx
call fcn.1001d590
add esp, 0xc
mov eax, dword [0x101c0870]
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
mov dword [ebp - 0x2bb8], edx
mov edx, dword [0x101c0870]
add edx, 1
mov dword [0x101c0870], edx
push str.SoftWareTrojanCut_tc_Files
lea eax, [ebp - 0x3bc8]
push eax
call fcn.1001d9ee
add esp, 8
mov ecx, dword [ebp - 0x2bb8]
push ecx
push 0x10037b5c
lea edx, [ebp - 0x1590]
push edx
call fcn.1001d9ee
add esp, 0xc
lea eax, [ebp - 0x1ba0]
push eax
call fcn.1001a420
add esp, 4
mov ecx, dword [ebp - 0x37c8]
mov dword [ebp - 0x2bb4], ecx
mov byte [ebp - 0x2dc0], 0
push 0x1ff
push 0
lea edx, [ebp - 0x2dbf]
push edx
call fcn.1001d590
add esp, 0xc
lea eax, [ebp - 0x2bb0]
push eax
call fcn.10013560
add esp, 4
lea ecx, [ebp - 0x2bb0]
push ecx
call fcn.10013540
add esp, 4
mov dword [ebp - 0x1ba4], eax
cmp dword [ebp - 0x1ba4], 0
je 0x10014345
mov edx, dword [ebp - 0x1ba4]
push edx
push 0x10037b60
push 0x200
lea eax, [ebp - 0x2dc0]
push eax
call fcn.10020c9f
add esp, 0x10
jmp 0x10014359
push 0x10037b74
lea ecx, [ebp - 0x2dc0]
push ecx
call fcn.10003f20
add esp, 8
mov byte [ebp - 0x19a0], 0
push 0x400
push 0
lea edx, [ebp - 0x199f]
push edx
call fcn.1001d590
add esp, 0xc
mov eax, dword [0x1003e6ec]
and eax, 0x2000
je 0x100143a0
cmp dword [ebp + 0x18], 0
je 0x100143a0
push 0x200
lea ecx, [ebp - 0x19a0]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call fcn.1001aec0
add esp, 0xc
mov eax, dword [ebp - 0x37c8]
and eax, 1
je 0x1001456c
mov ecx, dword [0x1003e6f4]
and ecx, 2
je 0x1001456c
push 0xa00
lea edx, [ebp - 0x37c0]
push edx
call fcn.1000eb30
add esp, 8
cmp dword [0x100e0004], 0x88
jne 0x100143ed
push str.SendInfoDisplay_disp_6
push 0
call fcn.1001a870
add esp, 8
mov byte [ebp - 0x45d8], 0
push 0x1ff
push 0
lea eax, [ebp - 0x45d7]
push eax
call fcn.1001d590
add esp, 0xc
lea ecx, [ebp - 0x45d8]
push ecx
lea edx, [ebp - 0x1ba0]
push edx
call fcn.1001d100
add esp, 8
cmp dword [0x100e0004], 0x88
jne 0x1001443b
push str.SendInfoDisplay_disp_66
push 0
call fcn.1001a870
add esp, 8
push 0x10037bac
lea eax, [ebp - 0x1ba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10014481
push 0x10037bbc
lea ecx, [ebp - 0x1ba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10014481
push 0x10037bc8
lea edx, [ebp - 0x1ba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10014516
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x49e0]
push eax
call fcn.1001e050
add esp, 8
push 0x20
lea ecx, [ebp - 0x49e0]
push ecx
call fcn.10003a50
add esp, 8
mov dword [ebp - 0x45dc], eax
cmp dword [ebp - 0x45dc], 0
jne 0x100144c5
lea edx, [ebp - 0x49e0]
mov dword [ebp - 0x45dc], edx
jmp 0x100144d4
mov eax, dword [ebp - 0x45dc]
add eax, 1
mov dword [ebp - 0x45dc], eax
lea ecx, [ebp - 0x37c0]
push ecx
mov edx, dword [ebp - 0x45dc]
push edx
lea eax, [ebp - 0x45d8]
push eax
lea ecx, [ebp - 0x1ba0]
push ecx
call fcn.10003c80
add esp, 4
push eax
lea edx, [ebp - 0x1ba0]
push edx
push 0x10037bd4
lea eax, [ebp - 0x27a8]
push eax
call fcn.1001d9ee
add esp, 0x1c
jmp 0x1001454f
lea ecx, [ebp - 0x37c0]
push ecx
lea edx, [ebp - 0x45d8]
push edx
lea eax, [ebp - 0x1ba0]
push eax
call fcn.10003c80
add esp, 4
push eax
lea ecx, [ebp - 0x1ba0]
push ecx
push 0x10037be8
lea edx, [ebp - 0x27a8]
push edx
call fcn.1001d9ee
add esp, 0x18
cmp dword [0x100e0004], 0x88
jne 0x1001456a
push str.SendInfoDisplay_disp_666
push 0
call fcn.1001a870
add esp, 8
jmp 0x10014582
lea eax, [ebp - 0x1ba0]
push eax
lea ecx, [ebp - 0x27a8]
push ecx
call fcn.10003f20
add esp, 8
cmp dword [0x100e0004], 0x88
je 0x100145a0
cmp dword [0x100e0004], 0x44
je 0x100145a0
cmp dword [0x100e0004], 2
jne 0x100145b6
lea edx, [ebp - 0x27a8]
push edx
push str._tSendInfoDisplay_:__s
push 0
call fcn.1001a870
add esp, 0xc
cmp dword [ebp + 0x1c], 0
je 0x100145f1
push 0x10037c28
push 0x100df7a0
call fcn.10003d90
add esp, 8
test eax, eax
jne 0x100145ef
push 0x10037c34
mov eax, dword [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100145ef
mov dword [ebp - 0x37c8], 2
jmp 0x1001462a
push str.rdpclip.exe
push 0x100df7a0
call fcn.10003d90
add esp, 8
test eax, eax
jne 0x1001462a
push str._tsclient
mov ecx, dword [ebp - 0x49e8]
add ecx, 0x58
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001462a
mov dword [ebp - 0x37c8], 2
lea edx, [ebp - 0x27a8]
push edx
call fcn.1001d4f0
add esp, 4
cmp eax, 0xa00
jbe 0x10014647
mov byte [ebp - 0x1da9], 0
mov eax, dword [0x1003e6ec]
and eax, 0x2000
je 0x10014667
cmp dword [ebp + 0x18], 0
je 0x10014667
lea ecx, [ebp - 0x19a0]
mov dword [ebp - 0x49f8], ecx
jmp 0x10014671
mov dword [ebp - 0x49f8], 0x100365f3
cmp dword [ebp + 0x1c], 0
je 0x10014682
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x49fc], edx
jmp 0x10014691
mov eax, dword [ebp - 0x49e8]
add eax, 0x58
mov dword [ebp - 0x49fc], eax
mov ecx, dword [ebp - 0x49f8]
push ecx
mov edx, dword [ebp + 8]
or edx, dword [ebp - 0x3bcc]
push edx
mov eax, dword [ebp - 0x49e8]
mov ecx, dword [eax + 0x8b2c]
push ecx
mov edx, dword [ebp - 0x49fc]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x3bd0]
push ecx
lea edx, [ebp - 0x27a8]
push edx
mov eax, dword [ebp - 0x2bb4]
push eax
lea ecx, [ebp - 0x2dc0]
push ecx
push str._s_d_s_s_d_s_d_d_s
lea edx, [ebp - 0x1390]
push edx
call fcn.1001d9ee
add esp, 0x2c
mov eax, dword [ebp - 0x3bd0]
push eax
call fcn.1001d4f0
add esp, 4
test eax, eax
ja 0x10014704
xor eax, eax
jmp 0x100148f8
lea ecx, [ebp - 0x1390]
push ecx
lea edx, [ebp - 0x1590]
push edx
lea eax, [ebp - 0x3bc8]
push eax
push reloc.WS2_32.dll_bind
call fcn.1001cc90
add esp, 0x10
cmp dword [0x100e0004], 0x88
je 0x10014744
cmp dword [0x100e0004], 0x44
je 0x10014744
cmp dword [0x100e0004], 2
jne 0x10014768
lea ecx, [ebp - 0x1390]
push ecx
lea edx, [ebp - 0x1590]
push edx
lea eax, [ebp - 0x3bc8]
push eax
push str.SendInfoDisplay_disp_sKey_:__s_sVal_:__s_sData_:__s
push 0
call fcn.1001a870
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x10037ca8
push 0x10037cb0
push reloc.WS2_32.dll_bind
call fcn.1001c430
add esp, 0x10
cmp dword [0x100e0004], 0x11
je 0x100147a1
cmp dword [0x100e0004], 0x44
je 0x100147a1
cmp dword [0x100e0004], 2
jne 0x100147b7
lea ecx, [ebp - 0x1390]
push ecx
push str.SendInfoDisplay_OK__s_
push 0
call fcn.1001a870
add esp, 0xc
lea edx, [ebp - 0x2dc0]
push edx
mov eax, dword [ebp - 0x3bd0]
push eax
call fcn.10012460
add esp, 8
push 0x10037ce4
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
jne 0x100147fc
push 0x10037cf8
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
jne 0x10014824
push 0
push 0x10037d0c
push 0x10037d14
push reloc.WS2_32.dll_bind
call fcn.1001c110
add esp, 0x10
mov dword [ebp - 0x1594], eax
cmp dword [ebp - 0x1594], 0
je 0x1001484d
mov ecx, dword [ebp - 0x2bb4]
push ecx
mov edx, dword [ebp - 0x2bb8]
push edx
push 0xc98
mov eax, dword [ebp - 0x1594]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x100e0004], 0x88
jne 0x10014876
mov ecx, dword [ebp - 0x2bb4]
push ecx
mov edx, dword [ebp - 0x2bb8]
push edx
push str.SendInfoDisplay_disp_WPARAM_:__d_LPARAM_:__d
push 0
call fcn.1001a870
add esp, 0x10
mov byte [0x101c07fe], 0
cmp dword [0x100e0004], 0x11
jne 0x1001489f
mov eax, dword [ebp - 0x37c8]
and eax, 1
push eax
push str.SendInfoDisplay_flag__SEND_CUT__d_
push 0
call fcn.1001a870
add esp, 0xc
mov ecx, dword [0x100e0ddc]
and ecx, 0x20000000
je 0x100148ef
cmp dword [ebp - 0x37c8], 0x11
je 0x100148bf
cmp dword [ebp - 0x37c8], 0x21
jne 0x100148ef
cmp dword [0x100e161c], 0
jne 0x100148d3
movzx edx, byte [0x100dcea3]
test edx, edx
je 0x100148ef
lea eax, [ebp - 0x49e4]
push eax
push 0
push 0
push 0x1000b870
push 0
push 0
call fcn.100210ef
add esp, 0x18
mov eax, dword [ebp - 0x37c8]
and eax, 1
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1001d57b
mov esp, ebp
pop ebp
ret 0x18