Function at 0x100379c5
Capabilities:
Accept command line arguments
Create thread
Enumerate gui resources
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x4568]
mov eax, 0x45e8
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x4564], eax
mov eax, dword [ebp + 0x4580]
push ebx
mov ebx, dword [ebp + 0x4578]
push esi
push edi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x4584]
push 4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x457c]
push 0x1005f800
push ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x38], eax
call fcn.10041e10
add esp, 0xc
lea edx, [ebp + 0x4364]
test eax, eax
jne 0x10037a39
lea eax, [ebx + 4]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10037a2d
jmp 0x10037a47
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10037a3d
cmp dword [0x101434ac], 0
je 0x10037a6e
movzx eax, byte [ebp + 0x4588]
push eax
lea eax, [ebp + 0x4364]
push eax
push str.SendInfoDisplay_start:_s__d_
push 0
call fcn.1003dfed
add esp, 0x10
cmp byte [0x1029dfec], 0
jne 0x10037b09
test byte [0x1013dc2c], 0x10
je 0x10037b09
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
xor eax, eax
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
xor esi, esi
push esi
push esi
push dword [ebp - 0x50]
call fcn.10043420
mov ecx, dword [ebp - 0x54]
xor edi, edi
add eax, ecx
adc edx, edi
add eax, 0x5f5e100
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x80]
adc edx, esi
push eax
mov dword [ebp - 0x50], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x10037b2b
mov byte [0x1029dfec], al
lea eax, [ebp + 0x4364]
push eax
call fcn.1002ab17
pop ecx
test eax, eax
je 0x10037b6f
cmp dword [0x101434ac], 0
je 0x10037b68
push ebx
push str.isLastXferFilter__s_
jmp 0x10037b5e
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x10142848
push ebx
call esi
test eax, eax
jne 0x10037b49
push str..dll
push ebx
call esi
test eax, eax
je 0x10037b09
cmp dword [0x101434ac], 0
je 0x10037b68
lea eax, [ebp + 0x4364]
push eax
push str.SendInfoDisplay_exp:_s
push 0
call fcn.1003dfed
add esp, 0xc
xor eax, eax
jmp 0x10039024
lea eax, [ebp + 0x4364]
push eax
call fcn.10035d02
pop ecx
test al, al
je 0x10037b91
cmp dword [0x101434ac], 0
je 0x10037b68
push ebx
push str.isWhiteFileExt__s_
jmp 0x10037b5e
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x10037b9d
cmp byte [eax], 0
jne 0x10037ba3
mov eax, dword [ebp - 0x30]
add eax, 0x58
test dword [ebp + 0x4570], 0x1000
mov dword [ebp - 0x40], eax
je 0x10037c08
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10037bb7
sub eax, edx
cmp eax, 1
jbe 0x10037bf1
cmp byte [ebx + 1], 0x3a
je 0x10037bf1
push 0x2e
push ebx
call fcn.10040730
pop ecx
pop ecx
test eax, eax
jne 0x10037bf1
mov edx, 0x1029e410
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10037be2
jmp 0x10037b1a
cmp byte [0x1029e410], 0
jne 0x10037c08
mov esi, str.BlueTooth
mov edi, 0x1029e410
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [0x101104b0], 0
je 0x10037c69
mov edi, dword [ebp - 0x30]
add edi, 0x58
mov esi, 0x101104b0
mov ecx, esi
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10037c3e
test dl, dl
je 0x10037c3a
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10037c3e
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x10037c20
xor eax, eax
jmp 0x10037c43
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10037c69
cmp dword [0x101434ac], eax
je 0x10037b68
push ebx
push edi
push esi
push str.g_tc_GW__s___s___s_
push eax
call fcn.1003dfed
add esp, 0x14
jmp 0x10037b68
mov esi, dword [ebp - 0x40]
push 0xa
mov edi, str.127.0.0.1
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x10037c91
cmp dword [0x101434ac], eax
je 0x10037b68
push ebx
push str.127.0.0.1__s_
jmp 0x10037b5e
cmp byte [0x10141c3b], 0
mov eax, dword [ebp + 0x4574]
mov dword [ebp - 0x2c], eax
je 0x10037e33
xor ecx, ecx
cmp dword [0x10144ec4], ecx
je 0x10037d94
cmp dword [ebp - 0x34], ecx
je 0x10037cf4
cmp dword [ebp - 0x34], 0x99
je 0x10037cf4
cmp dword [ebp - 0x3c], ecx
je 0x10037d25
mov eax, dword [ebp - 0x3c]
cmp byte [eax], cl
je 0x10037d25
push eax
call fcn.1000308b
pop ecx
test al, al
jne 0x10037d25
cmp dword [0x101434ac], 0
mov dword [ebp - 0x2c], 1
je 0x10037d53
push dword [ebp - 0x3c]
push str.SendInfoDisplay_PE_IE_cut_sDest:_s
jmp 0x10037d1b
mov esi, dword [ebp - 0x30]
add esi, 0x58
push esi
call fcn.1000308b
pop ecx
test al, al
jne 0x10037d81
cmp dword [0x101434ac], 0
mov dword [ebp - 0x2c], 1
je 0x10037d53
push esi
push str.SendInfoDisplay_PE_IE_cut_m_szIPAddress:_s
push 0
call fcn.1003dfed
add esp, 0xc
cmp dword [0x101434ac], 0
je 0x10037d53
lea eax, [ebp + 0x4364]
push eax
push dword [0x1014469c]
push dword [ebp - 0x2c]
push dword [ebp + 0x4570]
push str.SendInfoDisplay_1__08x__08x__08x__s
push 0
call fcn.1003dfed
add esp, 0x18
test dword [ebp + 0x4570], 0x2000
je 0x10037f0c
mov eax, dword [0x10144ecc]
cmp eax, 3
jle 0x10037eed
push dword [0x1013ee84]
push 0x100357c2
jmp 0x10037efc
cmp dword [0x101434ac], 0
je 0x10037d53
push str.SendInfoDisplay_PE_IE_OK
jmp 0x10037e25
cmp byte [0x10144ec0], 0
je 0x10037e33
cmp byte [0x10092aa8], 0
je 0x10037db6
cmp dword [0x100724a8], 0x5b6a7988
jne 0x10037dbd
mov dword [ebp - 0x2c], 1
cmp byte [0x10093728], 0
mov byte [0x10092aa8], 0
je 0x10037e13
cmp dword [ebp - 0x34], ecx
je 0x10037de0
cmp dword [ebp - 0x34], 0x99
je 0x10037de0
push dword [ebp - 0x3c]
jmp 0x10037de7
mov eax, dword [ebp - 0x30]
add eax, 0x58
push eax
call fcn.1000305f
pop ecx
test al, al
je 0x10037df8
mov dword [ebp - 0x2c], 1
cmp dword [0x101434ac], 0
je 0x10037d53
push str.SendInfoDisplay_disp
push 0
call fcn.1003dfed
pop ecx
pop ecx
cmp dword [0x101434ac], 0
je 0x10037d53
push str.SendInfoDisplay_g_tc_PE_IE__g_sbIsExplorer
push 0
call fcn.1003dfed
pop ecx
pop ecx
jmp 0x10037d25
test dword [0x1013dc2c], 0x1000
je 0x10037d25
test al, 1
je 0x10037d25
cmp dword [ebp - 0x34], 0
je 0x10037d25
lea eax, [ebp + 0x4364]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10037e5e
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
sub eax, edx
mov esi, eax
push str..EXE
lea eax, [ebp + 0x4364]
push eax
call edi
lea ecx, [ebp + esi + 0x4360]
cmp eax, ecx
je 0x10037eb9
lea eax, [ebp + 0x4364]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10037e91
sub eax, edx
mov esi, eax
push str..DLL
lea eax, [ebp + 0x4364]
push eax
call edi
lea ecx, [ebp + esi + 0x4360]
cmp eax, ecx
jne 0x10037d25
mov eax, dword [ebp - 0x34]
cmp byte [eax], 0x4d
jne 0x10037d25
cmp byte [eax + 1], 0x5a
jne 0x10037d25
cmp dword [0x101434ac], 0
je 0x10037b68
lea eax, [ebp + 0x4364]
push eax
push str.SendInfoDisplay_1_1_
jmp 0x10037b5e
test eax, eax
je 0x10037f04
push dword [0x1013ee84]
push 0x100358b4
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10037f0c
push 0
call fcn.10035740
pop ecx
movzx ecx, byte [0x10144eeb]
mov eax, dword [0x1029e3f4]
neg ecx
sbb ecx, ecx
and ecx, 0x2200
or ecx, eax
or ecx, 0x800
or dword [ebp + 0x4570], ecx
cmp dword [0x10144ecc], 6
jne 0x10037f3f
or dword [ebp + 0x4570], eax
mov ecx, dword [ebp - 0x30]
mov eax, 0x200
test dword [ecx + 0x3ea0], eax
je 0x10037f55
or dword [ebp + 0x4570], eax
test dword [ebp + 0x4570], 0x1000
je 0x10037f6b
and dword [ebp + 0x4570], 0xffffdfff
xor ebx, ebx
cmp dword [0x1029e3f8], ebx
je 0x10037f7f
or dword [ebp + 0x4570], 0x20000
cmp dword [0x101434ac], 0x11
jne 0x10037f9c
push dword [ebp + 0x4570]
push str._MediaType_0x_08x
push ebx
call fcn.1003dfed
add esp, 0xc
mov dword [0x1029e3f4], ebx
mov edi, str.SoftWareTrojanCut_tc_MultiX
mov esi, reloc.WS2_32.dll_bind
cmp dword [0x10144edc], ebx
jne 0x10037fc0
cmp byte [0x101400f6], bl
je 0x1003807e
push 0x10142a48
lea eax, [ebp + 0x3c60]
push str._s_U
push eax
call fcn.10040b98
push 0x104
lea eax, [ebp + 0x4060]
push eax
lea eax, [ebp + 0x3c60]
push eax
push edi
push esi
call fcn.1003e4ea
add esp, 0x20
cmp eax, 0xffffffff
jne 0x10037ffe
mov byte [ebp + 0x4060], bl
cmp dword [0x101434ac], ebx
je 0x10038023
lea eax, [ebp + 0x4060]
push eax
lea eax, [ebp + 0x3c60]
push eax
push str.SendInfoDisplay_sTC_Chrome___s__value__s_
push 0
call fcn.1003dfed
add esp, 0x10
cmp byte [0x1013f2f0], 0
mov ebx, str.mail
je 0x10038041
push ebx
push 0x1013f2f0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003805c
cmp byte [ebp + 0x4060], 0
je 0x10038068
push ebx
lea eax, [ebp + 0x4060]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10038068
or dword [ebp + 0x4570], 0x200
jmp 0x1003807e
push 0x1005ce9d
lea eax, [ebp + 0x3c60]
push eax
push edi
push esi
call fcn.1003ef27
add esp, 0x10
cmp dword [0x101434ac], 0
je 0x100380b2
lea eax, [ebp + 0x4364]
push eax
push dword [0x10144694]
push dword [0x1014469c]
push dword [ebp - 0x2c]
push dword [ebp + 0x4570]
push str.SendInfoDisplay_Out__08x__08x__08x__08x__s
push 0
call fcn.1003dfed
add esp, 0x1c
lea eax, [ebp + 0x4364]
push 0x3ff
mov dword [ebp - 0x48], eax
xor esi, esi
lea eax, [ebp + 0x1d61]
push esi
push eax
mov byte [ebp + 0x1d60], 0
call fcn.10040850
mov edi, dword [ebp + 0x4570]
add esp, 0xc
mov dword [ebp - 0x40], edi
and dword [ebp - 0x40], 0x4000000
mov ebx, 0x1ff
jne 0x10038191
lea eax, [ebp + 0x4364]
push 0x5c
push eax
call fcn.10040730
pop ecx
pop ecx
test eax, eax
jne 0x10038191
push ebx
mov byte [ebp + 0x3f64], al
lea eax, [ebp + 0x3f65]
push esi
push eax
call fcn.10040850
add esp, 0xc
lea eax, [ebp + 0x3f64]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x3f64]
push eax
lea eax, [ebp + 0x1d60]
push str._s_s
push eax
call fcn.10040b98
lea eax, [ebp + 0x1d60]
push esi
push eax
call fcn.10043bc5
add esp, 0x18
test eax, eax
je 0x10038188
lea eax, [ebp + 0x4364]
push eax
mov ecx, 0x10171a78
call fcn.1002832f
mov dword [ebp - 0x48], eax
cmp eax, esi
jne 0x10038191
lea eax, [ebp + 0x4364]
jmp 0x1003818e
lea eax, [ebp + 0x1d60]
mov dword [ebp - 0x48], eax
cmp dword [ebp + 0x457c], esi
jne 0x100381a5
push dword [ebp - 0x48]
call fcn.10007344
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x30]
call fcn.1003791c
test dword [0x1014469c], edi
je 0x10038353
test dword [0x1015bd84], 0x200
mov esi, 0x10085f90
mov edi, 0x1015cb88
je 0x10038210
cmp byte [0x1015cb88], 0
je 0x10038210
cmp byte [0x10085f90], 0
je 0x10038210
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10038210
cmp dword [0x101434ac], 0x11
jne 0x100383ca
push esi
push edi
push str._MediaType_pass_1___S___S_
push 0
call fcn.1003dfed
add esp, 0x10
jmp 0x100383ca
test dword [0x1015bd84], 0x200
mov edi, 0x10143248
je 0x1003825d
cmp byte [0x10143248], 0
je 0x1003825d
cmp byte [0x10142848], 0
je 0x1003825d
push 0x10142848
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003825d
cmp dword [0x101434ac], 0x11
jne 0x100383ca
push 0x10142848
push edi
push str._MediaType_pass_2___S___S_
jmp 0x10038201
test dword [ebp + 0x4570], 0x10000000
je 0x10038310
lea eax, [ebp + 0x4164]
push eax
lea eax, [ebp + 0x4364]
push eax
call fcn.1003591f
cmp byte [ebp + 0x4164], 0
pop ecx
pop ecx
je 0x100382a5
lea eax, [ebp + 0x4164]
push eax
push 0x1016bbf8
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10037b68
mov eax, dword [0x1015bd84]
test eax, 0x10000
je 0x100382e0
cmp byte [ebp + 0x4164], 0
je 0x100382d4
lea eax, [ebp + 0x4164]
push eax
push 0x1015cd88
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100383ca
mov dword [ebp - 0x2c], 0x11
jmp 0x100383ca
test eax, 0x20000
je 0x100382d4
cmp byte [ebp + 0x4164], 0
je 0x100383ca
lea eax, [ebp + 0x4164]
push eax
push 0x1015cd88
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100383ca
jmp 0x100382d4
push 0x11
pop eax
mov dword [ebp - 0x2c], eax
cmp dword [0x101434ac], eax
jne 0x100383ca
push 0x10142848
push edi
push esi
push 0x1015cb88
lea eax, [ebp + 0x4364]
push eax
mov eax, dword [0x10144ef0]
push esi
push dword [ebp - 0x38]
shl eax, 0xa
push eax
push str.SEND_CUTDEVICE3__08x____08x_host:__s__file:__s__g_tc_OKWebMail:__s__g_szMailFromHost:__s__g_tc_OKMsg:__s__g_szMyExeName:__s_
push 0
call fcn.1003dfed
add esp, 0x28
jmp 0x100383ca
mov ecx, dword [0x1015bd84]
mov eax, dword [0x10144ef0]
cmp dword [ebp - 0x38], esi
je 0x1003837b
mov edx, eax
shl edx, 0xa
cmp edx, dword [ebp - 0x38]
ja 0x1003837b
test ecx, 0x400
je 0x1003837b
test byte [ebp - 0x2c], 2
jne 0x10038399
mov edx, dword [0x10144efc]
shl edx, 0xa
cmp edx, dword [ebp - 0x38]
ja 0x100383ca
test ecx, 0x80000
je 0x100383ca
test edi, 0x200
je 0x100383ca
cmp dword [0x101434ac], 0x11
mov dword [ebp - 0x2c], 0x21
jne 0x100383ca
lea ecx, [ebp + 0x4364]
push ecx
push 0x10085f90
push dword [ebp - 0x38]
shl eax, 0xa
push eax
push str.SEND_CUTDEVICESIZE4__08x____08x_host:_s_file:_s
push esi
call fcn.1003dfed
add esp, 0x18
mov eax, dword [0x101446ac]
and eax, dword [ebp + 0x4570]
je 0x100383e4
cmp dword [ebp - 0x40], 0
je 0x100383e4
mov dword [ebp - 0x2c], 0x11
test eax, eax
je 0x100383fb
test dword [ebp + 0x4570], 0x1000
je 0x100383fb
mov dword [ebp - 0x2c], 0x11
lea eax, [ebp + 0x4364]
push eax
call fcn.10035ddc
pop ecx
test al, al
je 0x10038413
mov dword [ebp - 0x2c], 0x11
cmp byte [ebp + 0x4588], 0
jne 0x10038536
mov eax, dword [ebp - 0x60]
cmp byte [eax + 1], 0x3a
je 0x10038536
test byte [ebp + 0x4574], 1
jne 0x10038536
push 0x18
call fcn.10042eb7
mov esi, eax
pop ecx
test esi, esi
je 0x10038536
xor eax, eax
push 6
pop ecx
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x4570]
mov dword [esi], eax
mov eax, dword [ebp + 0x4574]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x457c]
mov dword [esi + 0xc], eax
lea eax, [ebp + 0x4364]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10038478
sub eax, ecx
inc eax
push eax
call fcn.10040c33
pop ecx
mov dword [esi + 8], eax
lea ecx, [ebp + 0x4364]
mov dl, byte [ecx]
inc ecx
mov byte [eax], dl
inc eax
test dl, dl
jne 0x10038492
mov edi, dword [ebp - 0x34]
xor ebx, ebx
cmp edi, ebx
je 0x100384ce
cmp byte [edi], bl
je 0x100384ce
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100384ae
sub eax, ecx
inc eax
push eax
call fcn.10040c33
pop ecx
mov dword [esi + 0x10], eax
mov edx, edi
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x100384c4
mov edi, dword [ebp - 0x3c]
cmp edi, ebx
je 0x100384fe
cmp byte [edi], bl
je 0x100384fe
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100384de
sub eax, ecx
inc eax
push eax
call fcn.10040c33
pop ecx
mov dword [esi + 0x14], eax
mov edx, edi
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x100384f4
lea eax, [ebp - 0x50]
push eax
push ebx
push esi
push 0x100376e6
push ebx
push ebx
call fcn.10041127
add esp, 0x18
mov dword [0x10092ccc], eax
cmp dword [0x101434ac], ebx
je 0x1003901e
push str.SendInfoDisplay_Out_2
push ebx
call fcn.1003dfed
pop ecx
pop ecx
jmp 0x1003901e
and dword [ebp - 0x58], 0
test byte [0x101446a0], 1
jne 0x1003862d
cmp dword [ebp - 0x38], 0xa
jbe 0x1003862d
push ebx
lea eax, [ebp + 0x4165]
push 0
push eax
mov byte [ebp + 0x4164], 0
call fcn.10040850
push 0x10061c4c
mov esi, 0x10142048
push esi
lea eax, [ebp + 0x4164]
push str.__s_s_
push eax
call fcn.10040b98
add esp, 0x1c
push str.Program_Files_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
push dword [ebp - 0x48]
lea eax, [ebp + 0x3b64]
push str._r___s_
push eax
call fcn.10040b98
mov edi, 0x91
add esp, 0xc
cmp dword [0x101434ac], edi
jne 0x100385d3
lea eax, [ebp + 0x3b64]
push eax
lea eax, [ebp + 0x4164]
push eax
push str._ShellExec_4_chk_PerInfo__s__sFName_s
push 0
call fcn.1003dfed
add esp, 0x10
push 0
push esi
lea eax, [ebp + 0x3b64]
push eax
lea eax, [ebp + 0x4164]
push eax
push str.open
push 0
push 0x1e
call fcn.1000cc2b
add esp, 0x1c
cmp eax, 0x3e7
jne 0x1003862d
cmp dword [0x101434ac], edi
jne 0x10038616
push dword [ebp - 0x48]
push str._Found_a_Personal_Information__s
push 0
call fcn.1003dfed
add esp, 0xc
test byte [0x101446ac], 1
je 0x10038626
mov dword [ebp - 0x2c], 0x11
mov dword [ebp - 0x58], 1
test byte [ebp - 0x2c], 1
je 0x100386be
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
test eax, eax
je 0x10038649
cmp byte [eax], cl
je 0x10038649
mov esi, dword [ebp - 0x30]
jmp 0x10038654
mov esi, dword [ebp - 0x30]
lea eax, [esi + 0x58]
cmp byte [eax], 0
je 0x10038656
mov ecx, eax
cmp dword [0x10144694], 2
push 0x42
pop edi
jne 0x10038667
mov dword [ebp - 0x2c], edi
jmp 0x1003869c
test ecx, ecx
je 0x1003869c
push 0x10149640
push 0x101497d0
push ecx
call fcn.10010200
add esp, 0xc
test al, al
je 0x1003869c
cmp dword [0x101434ac], 0x11
mov dword [ebp - 0x2c], edi
jne 0x1003869c
push str.SendInfoDisplay_disp_13
push 0
call fcn.1003dfed
pop ecx
pop ecx
cmp byte [0x10149960], 0
je 0x100386fe
push 0x10142848
push 0x10149960
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100386fe
mov dword [ebp - 0x2c], edi
jmp 0x100386fe
mov eax, dword [0x101446a0]
mov ecx, eax
and ecx, dword [ebp + 0x4570]
test ecx, 0xfffbffff
je 0x100386fb
cmp dword [0x101434ac], 0
je 0x10037b68
push dword [ebp + 0x4570]
push eax
push str.SendInfoDisplay_Except:_d__d_
push 0
call fcn.1003dfed
add esp, 0x10
jmp 0x10037b68
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
and eax, 1
mov dword [ebp - 0x64], eax
je 0x1003871e
mov byte [esi + 0x50bc], 1
mov byte [esi + 0x1470], 1
mov byte [esi + 0x630c], 1
lea eax, [ebp + 0x4364]
push eax
mov byte [esi + 0x50bd], 0
mov byte [esi + 0x50bf], 0
call fcn.1000efdd
pop ecx
test eax, eax
je 0x10038745
mov eax, dword [ebp - 0x64]
jmp 0x10039024
cmp dword [0x101434ac], 0
je 0x10038764
lea eax, [ebp + 0x4364]
push eax
push str.SendInfoDisplay_disp_3:_s
push 0
call fcn.1003dfed
add esp, 0xc
push ebx
xor esi, esi
lea eax, [ebp + 0x2f61]
push esi
push eax
mov byte [ebp + 0x2f60], 0
call fcn.10040850
mov eax, dword [0x1013ee84]
add eax, 0xea60
push eax
mov edi, 0x1005d13c
lea eax, [ebp + 0x2f60]
push edi
push eax
call fcn.10040b98
push ebx
lea eax, [ebp + 0x3565]
push esi
push eax
mov byte [ebp + 0x3564], 0
call fcn.10040850
push ebx
lea eax, [ebp + 0x3d65]
push esi
push eax
mov byte [ebp + 0x3d64], 0
call fcn.10040850
push ebx
lea eax, [ebp + 0x3765]
push esi
push eax
mov byte [ebp + 0x3764], 0
call fcn.10040850
push 0x1387
lea eax, [ebp + 0x9d9]
push esi
push eax
mov byte [ebp + 0x9d8], 0
call fcn.10040850
add esp, 0x48
mov esi, 0x9ff
push esi
lea eax, [ebp - 0x27]
push 0
push eax
mov byte [ebp - 0x28], 0
call fcn.10040850
push esi
lea eax, [ebp + 0x2161]
push 0
push eax
mov byte [ebp + 0x2160], 0
call fcn.10040850
mov eax, dword [0x1029e3fc]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x3564]
push str.SoftWareTrojanCut_tc_Files
push eax
mov esi, edx
add esi, 0x64
inc dword [0x1029e3fc]
mov dword [ebp - 0x50], esi
call fcn.10040b98
push esi
lea eax, [ebp + 0x3764]
push edi
push eax
call fcn.10040b98
lea eax, [ebp + 0x3d64]
push eax
call fcn.1003dc1e
mov eax, dword [ebp - 0x2c]
push ebx
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x3965]
push 0
push eax
mov byte [ebp + 0x3964], 0
call fcn.10040850
lea eax, [ebp - 0x70]
push eax
call fcn.10040fd5
lea eax, [ebp - 0x70]
add esp, 0x40
push eax
call fcn.10040fae
pop ecx
test eax, eax
je 0x100388b6
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x3964]
push 0x200
push eax
call fcn.10041c5f
add esp, 0x10
jmp 0x100388c9
lea eax, [ebp + 0x3964]
push str.0000
push eax
call fcn.100074d8
pop ecx
pop ecx
push 0x400
xor edi, edi
lea eax, [ebp + 0x3161]
push edi
push eax
mov byte [ebp + 0x3160], 0
call fcn.10040850
add esp, 0xc
test dword [0x10072cc0], 0x2000
je 0x1003890f
cmp dword [ebp - 0x34], edi
je 0x1003890f
push 0x200
lea eax, [ebp + 0x3160]
push eax
push dword [ebp - 0x34]
call fcn.1003d597
add esp, 0xc
mov esi, 0x88
cmp dword [ebp - 0x64], edi
je 0x10038a9c
test byte [0x10072cc8], 2
je 0x10038a9c
lea eax, [ebp - 0x28]
push 0xa00
push eax
call fcn.100317d6
pop ecx
pop ecx
cmp dword [0x101434ac], esi
jne 0x1003894f
push str.SendInfoDisplay_disp_6
push edi
call fcn.1003dfed
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x4165]
push edi
push eax
mov byte [ebp + 0x4164], 0
call fcn.10040850
lea eax, [ebp + 0x4164]
push eax
lea eax, [ebp + 0x3d64]
push eax
call fcn.1003d99e
add esp, 0x14
cmp dword [0x101434ac], esi
jne 0x1003898f
push str.SendInfoDisplay_disp_66
push edi
call fcn.1003dfed
pop ecx
pop ecx
cmp byte [0x1029dff0], 0
je 0x100389ac
xor eax, eax
mov cl, byte [eax + 0x1029dff0]
mov byte [ebp + eax + 0x3d64], cl
inc eax
test cl, cl
jne 0x1003899a
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.rundll32.exe
lea eax, [ebp + 0x3d64]
push eax
call ebx
test eax, eax
jne 0x10038a1e
push 0x10063b10
lea eax, [ebp + 0x3d64]
push eax
call ebx
test eax, eax
jne 0x10038a1e
push str.svchost.exe
lea eax, [ebp + 0x3d64]
push eax
call ebx
test eax, eax
jne 0x10038a1e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x4164]
push eax
lea eax, [ebp + 0x3d64]
push eax
call fcn.10007344
pop ecx
push eax
lea eax, [ebp + 0x3d64]
push eax
lea eax, [ebp + 0x2160]
push str._s__d__s__s
push eax
call fcn.10040b98
add esp, 0x18
jmp 0x10038a86
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp + 0x2b60]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x10038a2a
lea eax, [ebp + 0x2b60]
push 0x20
push eax
call fcn.10040730
pop ecx
pop ecx
cmp eax, edi
jne 0x10038a50
lea eax, [ebp + 0x2b60]
jmp 0x10038a51
inc eax
lea ecx, [ebp - 0x28]
push ecx
push eax
lea eax, [ebp + 0x4164]
push eax
lea eax, [ebp + 0x3d64]
push eax
call fcn.10007344
pop ecx
push eax
lea eax, [ebp + 0x3d64]
push eax
lea eax, [ebp + 0x2160]
push str._s__d__s__s_0___s
push eax
call fcn.10040b98
add esp, 0x1c
mov eax, dword [0x101434ac]
cmp eax, esi
jne 0x10038add
push str.SendInfoDisplay_disp_666
push edi
call fcn.1003dfed
jmp 0x10038ad2
cmp byte [0x1029dff0], 0
je 0x10038ab9
xor eax, eax
mov cl, byte [eax + 0x1029dff0]
mov byte [ebp + eax + 0x3d64], cl
inc eax
test cl, cl
jne 0x10038aa7
lea eax, [ebp + 0x3d64]
push eax
lea eax, [ebp + 0x2160]
push eax
call fcn.100074d8
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov eax, dword [0x101434ac]
pop ecx
pop ecx
cmp eax, esi
je 0x10038ae7
cmp eax, 0x44
je 0x10038ae7
cmp eax, 2
jne 0x10038b03
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x2160]
push eax
push str._tSendInfoDisplay_:__s__s_
push edi
call fcn.1003dfed
add esp, 0x10
mov esi, dword [ebp - 0x3c]
push str.rdpclip.exe
push 0x10142848
call fcn.1000740e
pop ecx
pop ecx
cmp esi, edi
je 0x10038bd2
test eax, eax
jne 0x10038b36
push str._tsclient
push esi
call ebx
test eax, eax
je 0x10038b36
mov dword [ebp - 0x2c], 2
mov edi, dword [ebp - 0x30]
lea eax, [ebp + 0x2160]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10038b42
sub eax, edx
cmp eax, 0xa00
jbe 0x10038b58
mov byte [ebp + 0x2b5f], cl
test byte [0x1013ee90], 1
je 0x10038bfc
test dword [0x10072cc0], 0x2000
je 0x10038b7d
cmp dword [ebp - 0x34], 0
lea eax, [ebp + 0x3160]
jne 0x10038b82
mov eax, 0x1005ce9d
mov ecx, esi
test esi, esi
jne 0x10038b8b
lea ecx, [edi + 0x58]
push 0x1013cfe0
push eax
mov eax, dword [ebp - 0x58]
or eax, dword [ebp + 0x4570]
push eax
push dword [edi + 0x8b2c]
lea eax, [ebp + 0x2160]
push ecx
push dword [ebp - 0x38]
push dword [ebp - 0x48]
push eax
push dword [ebp - 0x40]
lea eax, [ebp + 0x3964]
push eax
lea eax, [ebp + 0x9d8]
push str._s_d_s_s_d_s_d_d_s_s
push eax
call fcn.10040b98
add esp, 0x30
jmp 0x10038ca0
mov edi, dword [ebp - 0x30]
test eax, eax
jne 0x10038b39
push str._tsclient
lea eax, [edi + 0x58]
push eax
call ebx
test eax, eax
je 0x10038b39
mov dword [ebp - 0x2c], 2
jmp 0x10038b39
test dword [ebp + 0x4570], 0x1000
je 0x10038c3d
test dword [0x10072cc0], 0x2000
je 0x10038c20
cmp dword [ebp - 0x34], 0
lea eax, [ebp + 0x3160]
jne 0x10038c25
mov eax, 0x1005ce9d
push eax
mov eax, dword [ebp - 0x58]
or eax, dword [ebp + 0x4570]
push eax
push dword [edi + 0x8b2c]
push 0x1029e410
jmp 0x10038c75
test dword [0x10072cc0], 0x2000
je 0x10038c55
cmp dword [ebp - 0x34], 0
lea eax, [ebp + 0x3160]
jne 0x10038c5a
mov eax, 0x1005ce9d
mov ecx, esi
test esi, esi
jne 0x10038c63
lea ecx, [edi + 0x58]
push eax
mov eax, dword [ebp - 0x58]
or eax, dword [ebp + 0x4570]
push eax
push dword [edi + 0x8b2c]
push ecx
push dword [ebp - 0x38]
lea eax, [ebp + 0x2160]
push dword [ebp - 0x48]
push eax
push dword [ebp - 0x40]
lea eax, [ebp + 0x3964]
push eax
lea eax, [ebp + 0x9d8]
push str._s_d_s_s_d_s_d_d_s
push eax
call fcn.10040b98
add esp, 0x2c
lea eax, [ebp + 0x9d8]
push eax
lea eax, [ebp + 0x3764]
push eax
lea eax, [ebp + 0x3564]
push eax
mov edi, reloc.WS2_32.dll_bind
push edi
call fcn.1003ef27
mov eax, dword [0x101434ac]
add esp, 0x10
cmp eax, 0x88
je 0x10038cd9
cmp eax, 0x44
je 0x10038cd9
cmp eax, 2
jne 0x10038cfd
lea eax, [ebp + 0x9d8]
push eax
lea eax, [ebp + 0x3764]
push eax
lea eax, [ebp + 0x3564]
push eax
push str.SendInfoDisplay_disp_sKey_:__s_sVal_:__s_sData_:__s
push 0
call fcn.1003dfed
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARETrojanCut_tc_Env
push edi
call fcn.1003e718
add esp, 0x10
cmp dword [0x10144edc], 0
je 0x10038d83
mov ecx, dword [0x10072cc0]
mov eax, 0x5000
and ecx, eax
cmp ecx, eax
jne 0x10038d83
push 0x10142a48
lea eax, [ebp + 0x3c60]
push 0x1005d458
push eax
call fcn.10040b98
push 0x1005ce9d
lea eax, [ebp + 0x3c60]
push eax
push str.SoftWareTrojanCut_tc_MultiX
push edi
call fcn.1003ef27
mov eax, dword [0x101434ac]
add esp, 0x1c
cmp eax, 0x56
je 0x10038d75
cmp eax, 0x10
je 0x10038d75
cmp eax, 3
jne 0x10038d83
push str.isXferPacket_MySetRegUserStr_clear2
push 0
call fcn.1003dfed
pop ecx
pop ecx
lea eax, [ebp + 0x3964]
push eax
push dword [ebp - 0x48]
call fcn.10035acc
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
pop ecx
pop ecx
mov ebx, 0x1005d094
push ebx
push 0
call edi
mov esi, eax
test esi, esi
jne 0x10038dd2
push ebx
push eax
call edi
mov esi, eax
test esi, esi
jne 0x10038dd2
push eax
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.WS2_32.dll_bind
call fcn.1003d897
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10038de4
push dword [ebp - 0x40]
push dword [ebp - 0x50]
push 0xc98
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
xor edi, edi
cmp dword [0x101434ac], edi
je 0x10038e0b
lea eax, [ebp + 0x9d8]
push eax
lea eax, [ebp + 0x3764]
push eax
push esi
push str.SendInfoDisplay_File_0x_08x___s___s_
push edi
call fcn.1003dfed
add esp, 0x14
cmp dword [0x101434ac], 0x11
mov byte [0x1029e400], 0
jne 0x10038e30
mov eax, dword [ebp - 0x2c]
and eax, 1
push eax
push str.SendInfoDisplay_flag__SEND_CUT__d_
push edi
call fcn.1003dfed
add esp, 0xc
test dword [0x10144688], 0x20000000
je 0x10038e6e
cmp dword [ebp - 0x2c], 0x11
je 0x10038e48
cmp dword [ebp - 0x2c], 0x21
jne 0x10038e6e
cmp dword [0x10144ecc], edi
jne 0x10038e59
cmp byte [0x101400f6], 0
je 0x10038e6e
lea eax, [ebp - 0x50]
push eax
push edi
push edi
push 0x10011de7
push edi
push edi
call fcn.10041127
add esp, 0x18
cmp dword [0x10144edc], edi
jne 0x10038e83
cmp byte [0x10092cf8], 0
je 0x1003901e
push 0x10142a48
lea eax, [ebp + 0x3c60]
push str._s_D
push eax
call fcn.10040b98
push 0x208
lea eax, [ebp + 0x2d58]
push eax
lea eax, [ebp + 0x3c60]
push eax
mov edi, str.SoftWareTrojanCut_tc_MultiX
push edi
push reloc.WS2_32.dll_bind
call fcn.1003e4ea
add esp, 0x20
cmp byte [0x10092cf8], 0
lea ebx, [ebp + 0x2d58]
je 0x10038ed3
mov ebx, 0x10092cf8
cmp dword [0x101434ac], 0
je 0x10038eec
push ebx
push str.SendInfoDisplay_sTC_Chrome_D__s_
push 0
call fcn.1003dfed
add esp, 0xc
cmp byte [ebx], 0
je 0x10039005
mov esi, dword [ebp - 0x60]
cmp byte [esi + 1], 0x3a
jne 0x10038f43
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10038f20
lea edx, [ebp + 0x4060]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10038f14
jmp 0x10038f57
push 0x5c
push esi
call fcn.10042e20
pop ecx
pop ecx
test eax, eax
je 0x10038f57
inc eax
lea edx, [ebp + 0x4060]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10038f37
jmp 0x10038f57
lea edx, [ebp + 0x4060]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10038f4d
lea eax, [ebp + 0x4060]
push eax
push ebx
call fcn.10047de9
pop ecx
pop ecx
test eax, eax
jne 0x10038f83
cmp byte [0x10092cf8], al
je 0x10038f7c
mov byte [0x10092cf8], al
jmp 0x10039005
push 0x1005ce9d
jmp 0x10038ff0
lea eax, [ebp + 0x4060]
push eax
lea eax, [ebp + 0x4260]
push str.__s_
push eax
call fcn.10040b98
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x4260]
mov byte [ebp + eax + 0x4060], cl
inc eax
test cl, cl
jne 0x10038fa0
lea eax, [ebp + 0x4060]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10039005
lea ecx, [ebp + 0x4060]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10038fce
sub ecx, esi
add ecx, eax
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x10038fdd
cmp byte [0x10092cf8], al
jne 0x10039005
push ebx
lea eax, [ebp + 0x3c60]
push eax
push edi
push reloc.WS2_32.dll_bind
call fcn.1003ef27
add esp, 0x10
cmp dword [0x101434ac], 0
je 0x1003901e
push ebx
push str.SendInfoDisplay_sTC_Chrome_D_End__s_
push 0
call fcn.1003dfed
add esp, 0xc
mov eax, dword [ebp - 0x2c]
and eax, 1
mov ecx, dword [ebp + 0x4564]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x4568
leave
ret 0x1c