Function at 0x1003fb91
Capabilities:
Create thread

Disassembly:
sub esp, 0x40c
mov eax, dword [0x10084adc]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [esp + 0x414]
mov dword [esp + 8], ebx
call fcn.10059f30
test eax, eax
je 0x1003fbc2
xor eax, eax
inc eax
jmp 0x10040241
mov eax, dword [esp + 0x418]
push ebp
xor ebp, ebp
sub eax, ebp
push esi
push edi
je 0x10040195
dec eax
je 0x1003fbf7
dec eax
je 0x1003fbeb
dec eax
jne 0x100401cf
push ebx
call fcn.1003f4b7
jmp 0x1003fbf1
push ebx
call fcn.1003f480
pop ecx
jmp 0x1004023e
push 0x1003fb8c
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x102d3da8], eax
call fcn.1003f679
cmp eax, 0x600
mov dword [0x10078cd8], eax
jge 0x1003fc20
mov dword [0x10154a10], ebp
jmp 0x1003fc3d
push ebp
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call fcn.10040ccf
add esp, 0x10
mov dword [0x10154a10], eax
mov dword [0x102d3d9c], ebx
call fcn.1003f6ce
call fcn.1002da0e
mov esi, eax
cmp esi, ebp
je 0x1003fca6
push 0x200
lea eax, [esp + 0x1c]
push eax
push 0x8f
push dword [0x102d3d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x220]
push str._s_Stack_Size__d_Bytes
push eax
call fcn.10045378
lea eax, [esp + 0x228]
push eax
push str.StackOver......Except_OK__s_
push ebp
call fcn.100412e2
add esp, 0x1c
mov eax, 0x23785289
jmp 0x1004023e
call fcn.10020b41
mov dword [0x10084694], eax
cmp eax, 0x89578da3
jne 0x1004015d
call fcn.1003f804
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1002c57b
test eax, eax
setne al
pop ecx
mov byte [0x102d3d94], al
mov byte [0x10084690], 1
call fcn.10031078
or byte [0x102d3d93], al
cmp dword [0x10078cc4], ebp
jne 0x1003fcfb
mov dword [0x10078cc4], 0x111111
test dword [0x1015186c], 0x40000000
je 0x1003fd0e
call fcn.10026be8
jmp 0x1003fd44
mov eax, dword [0x10152ce0]
mov edx, dword [0x1015786c]
mov ecx, bind
cmp eax, 1
jne 0x1003fd31
test ecx, edx
jne 0x1003fd44
mov dword [0x10078cc4], 0x222222
cmp eax, 2
jne 0x1003fd44
test ecx, edx
jne 0x1003fd44
mov dword [0x10078cc4], 0xaaaaaa
mov eax, dword [0x10078cd8]
mov bl, byte [0x10084690]
mov edi, 0x602
lea esi, [edi - 1]
cmp eax, esi
lea ecx, [edi + 1]
mov edx, 0xa00
mov ebp, 0x500
jg 0x1003fdd5
cmp eax, 0x600
jge 0x1003fda4
cmp eax, ebp
je 0x1003fe09
lea ebx, [eax - 0x501]
cmp ebx, 1
ja 0x1003fe09
cmp byte [0x10084690], 0
mov ebx, dword [0x10078cc4]
jne 0x1003fdca
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 4
mov ebx, dword [esp + 0x10]
jmp 0x1003fdca
test bl, bl
mov ebx, dword [0x10078cc4]
je 0x1003fdbd
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 8
mov ebx, dword [esp + 0x10]
jmp 0x1003fdca
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 0xc
mov ebx, dword [esp + 0x10]
and ebx, 0xf
mov dword [0x102d3d98], ebx
jmp 0x1003fe13
cmp eax, edi
jl 0x1003fe09
cmp eax, ecx
jle 0x1003fde1
cmp eax, edx
jne 0x1003fe09
test bl, bl
mov ebx, dword [0x10078cc4]
je 0x1003fdfa
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 0x10
mov ebx, dword [esp + 0x10]
jmp 0x1003fdca
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 0x14
mov ebx, dword [esp + 0x10]
jmp 0x1003fdca
mov dword [0x102d3d98], 1
cmp dword [0x1015668c], 0
je 0x10040012
cmp eax, esi
jg 0x1003feef
mov edi, 0x600
cmp eax, edi
jge 0x1003fea0
cmp eax, ebp
je 0x1003fe86
lea ecx, [eax - 0x501]
cmp ecx, 1
ja 0x1003ff2b
test dword [0x1016ef6c], 0x40000000
je 0x1003ff3c
cmp eax, 0x502
jne 0x1003fe71
lea eax, [esp + 0x18]
push str.OS_2003
push eax
call fcn.1000789a
mov eax, dword [0x10078cd8]
pop ecx
pop ecx
cmp eax, 0x501
jne 0x1003ff3c
push str.OS_XP
jmp 0x1003ff30
test dword [0x1016ef6c], 0x40000000
je 0x1003ff3c
push str.OS_2000
jmp 0x1003ff30
test dword [0x1016ef6c], 0x40000000
je 0x1003ff3c
cmp eax, edi
jne 0x1003fee4
lea eax, [esp + 0x18]
push str.OS_VISTA
push eax
call fcn.1000789a
mov eax, dword [0x10078cd8]
pop ecx
pop ecx
cmp eax, edi
jne 0x1003fee4
lea eax, [esp + 0x18]
push str.OS_2008
push eax
call fcn.1000789a
mov eax, dword [0x10078cd8]
pop ecx
pop ecx
cmp eax, esi
jne 0x1003ff3c
push str.OS_7
jmp 0x1003ff30
cmp eax, edi
jl 0x1003ff2b
cmp eax, ecx
jle 0x1003fefb
cmp eax, edx
jne 0x1003ff2b
test dword [0x1016ef6c], 0x40000000
je 0x1003ff3c
cmp eax, edi
jne 0x1003ff3c
lea eax, [esp + 0x18]
push str.OS_8
push eax
call fcn.1000789a
pop ecx
pop ecx
cmp dword [0x10078cd8], edi
jne 0x1003ff3c
push str.OS_2012
jmp 0x1003ff30
push str.Unknown
lea eax, [esp + 0x1c]
push eax
call fcn.1000789a
pop ecx
pop ecx
xor ebx, ebx
test dword [0x1016ef6c], 0x40000000
mov edi, str.32bit_WoW_App
je 0x1003ffcb
cmp dword [0x10157ca4], ebx
je 0x1003ffcb
mov al, byte [0x102d3d98]
test al, 1
je 0x1003ff67
mov esi, 0x10070fb4
jmp 0x1003ff80
test al, 2
je 0x1003ff72
mov esi, 0x10070fb0
jmp 0x1003ff80
mov esi, 0x10070fac
test al, 4
jne 0x1003ff80
mov esi, str.UnKnown
cmp byte [0x10084690], 0
je 0x1003ffa5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1002c57b
pop ecx
test eax, eax
je 0x1003ff9e
mov eax, edi
jmp 0x1003ffaa
mov eax, str.32bit_____App
jmp 0x1003ffaa
mov eax, str.64bit_____App
push esi
push 0x10155a28
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x228]
push str._s__s__s__s_
push eax
call fcn.10045378
add esp, 0x18
cmp byte [0x10084690], 0
je 0x1003fff0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1002c57b
pop ecx
test eax, eax
je 0x1003ffe9
mov eax, edi
jmp 0x1003fff5
mov eax, str.32bit_App
jmp 0x1003fff5
mov eax, str.64bit_App
push dword [0x10078cc4]
push dword [0x102d3d98]
push eax
push str.This_is_a__s___Engine__d_g_tc_Engine_0x_08x_
push ebx
call fcn.100412e2
add esp, 0x14
jmp 0x10040014
xor ebx, ebx
cmp dword [0x102bfd64], ebx
jne 0x10040087
test dword [0x1015786c], 0x400
jne 0x10040087
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x10063b7c
mov edi, 0x10155228
push edi
call esi
test eax, eax
jne 0x10040087
push 0x1006bab4
push edi
call esi
test eax, eax
jne 0x10040087
push 0x1006baa8
push edi
call esi
test eax, eax
jne 0x10040087
push 0x1006ba9c
push edi
call esi
test eax, eax
jne 0x10040087
push 0x1006ba90
push edi
call esi
test eax, eax
jne 0x10040087
push 0x1006ba84
push edi
call esi
test eax, eax
jne 0x10040087
push 0x10063ac0
push edi
call esi
test eax, eax
je 0x1004008e
mov byte [0x102d3d90], 1
cmp dword [0x1015668c], ebx
je 0x100400bc
movzx eax, byte [0x102d3d91]
push eax
movzx eax, byte [0x102d3d90]
push eax
movzx eax, byte [0x102d3d93]
push eax
push str.This_is_a_g_bMetro__d_g_bRansomHigh__d_g_bRansomHighest__d_
push ebx
call fcn.100412e2
add esp, 0x14
mov esi, str.express_zip_file_compression
cmp byte [esi], 0
je 0x100400fa
cmp esi, str.This_is_a_g_bMetro__d_g_bRansomHigh__d_g_bRansomHighest__d_
jae 0x100400fa
push esi
push 0x10154168
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100400f7
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100400e4
sub eax, ecx
lea esi, [esi + eax + 1]
cmp esi, ebx
jne 0x100400c1
jmp 0x100400fa
or esi, 0xffffffff
cmp byte [0x102d3d90], 0
je 0x1004013d
cmp esi, 0xffffffff
je 0x1004013d
push str.tasklist.exe
mov esi, 0x10155628
push esi
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1004013d
push str.firefox.exe
push esi
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x1004013d
push dword [esp + 0x14]
call fcn.1003f588
jmp 0x100401cf
lea eax, [esp + 0x14]
push eax
push ebx
push dword [esp + 0x1c]
push fcn.1003f588
push ebx
push ebx
call fcn.1004592d
add esp, 0x18
mov dword [0x100a2bf4], eax
jmp 0x100401cf
cmp eax, 0x23785289
jne 0x10040178
cmp dword [0x1015668c], ebp
je 0x100401cf
push 0x100687c4
push str.found_OK_NOBHKOK__s_
jmp 0x1004018a
cmp dword [0x1015668c], ebp
je 0x100401cf
push 0x100687c4
push str.Cannot_found_ME_______s___perfectly_ridiculous.
push ebp
call fcn.100412e2
add esp, 0xc
jmp 0x100401cf
mov eax, dword [0x1015668c]
mov edi, 0x99
lea esi, [edi - 2]
cmp eax, esi
je 0x100401aa
cmp eax, edi
jne 0x100401b7
push str.DLL_PROCESS_DETACH_start
push ebp
call fcn.100412e2
pop ecx
pop ecx
push dword [0x102d3da8]
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp dword [0x10084694], 0x89578da3
je 0x100401d4
xor eax, eax
inc eax
jmp 0x1004023e
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x100401e1
cmp eax, edi
jne 0x100401f4
push 0x10155a28
push str.ProcessDetach:__s
push ebp
call fcn.100412e2
add esp, 0xc
push ebx
call fcn.1001e440
test eax, eax
pop ecx
setne bl
call fcn.1003f892
cmp dword [0x1015668c], ebp
je 0x10040223
xor eax, eax
test bl, bl
sete al
push eax
push str.DetachDetours_ENDsuccess__d_
push ebp
call fcn.100412e2
add esp, 0xc
push ebp
push str.tc_Scr
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
call fcn.10041a19
add esp, 0x10
movzx eax, bl
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40c]
pop ebx
xor ecx, esp
call fcn.1004501f
add esp, 0x40c
ret 0xc