Function at 0x10003230
Capabilities:
Create thread
Get hostname
Hide graphical window

Disassembly:
sub esp, 0x414
mov eax, dword [esp + 0x418]
mov ecx, dword [esp + 0x420]
mov edx, dword [esp + 0x424]
push ebx
push ebp
mov dword [0x1000e3b4], eax
mov eax, dword [esp + 0x448]
push esi
mov esi, dword [0x1000d440]
mov dword [0x1000e3e0], ecx
push edi
lea ecx, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x18], 0x28
mov dword [0x1000e3b0], edx
call esi
mov edx, dword [esp + 0x454]
lea eax, [esp + 0x224]
push edx
push eax
call esi
mov edi, dword [esp + 0x448]
mov ecx, dword [esp + 0x444]
mov edx, dword [esp + 0x44c]
mov ebp, dword [0x1000d434]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
mov dword [0x1000d47c], ecx
mov dword [0x1000d474], edx
call ebp
push 0
inc eax
push 0
push eax
push str.221.142.244.144
push 0xffffffffffffffff
push edi
push 0
push 0
call ebp
mov eax, dword [esp + 0x42c]
mov edi, 0x3c
cmp eax, edi
jge 0x100032f1
mov dword [0x1000e2a8], edi
mov ebx, dword [0x1000d438]
lea eax, [esp + 0x24]
push 0x1000c628
push eax
call ebx
test eax, eax
jne 0x10003326
lea ecx, [esp + 0x224]
push 0x1000c2a0
push ecx
call ebx
test eax, eax
jne 0x10003326
mov dword [0x1000c600], 0x1ac8
jmp 0x10003347
lea edx, [esp + 0x24]
push str.test
push edx
call esi
lea eax, [esp + 0x224]
push 0x1000c2a0
push eax
call esi
mov dword [0x1000e2a8], edi
mov edi, dword [esp + 0x440]
mov ebx, dword [0x1000d43c]
push 0x1000c614
push edi
call ebx
test eax, eax
je 0x100033b3
push 0x1000c60c
push edi
call ebx
test eax, eax
je 0x100033b3
push 0x1000c604
push edi
call ebx
test eax, eax
je 0x100033b3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp eax, 0xc04
jg 0x100033a3
je 0x1000349e
cmp eax, 0x404
je 0x1000349e
cmp eax, 0x804
jne 0x10003579
jmp 0x100033c3
cmp eax, 0x1004
jne 0x10003579
jmp 0x1000349e
push 0x1000c614
push edi
call ebx
test eax, eax
jne 0x1000348e
push 0x1000c594
push 0x1000e8e8
call esi
push 0x1000c588
push 0x1000e6e8
call esi
push str.S_MR
push str.OffLine_Now
call esi
push 0x1000c564
push 0x1000e3e4
call esi
push 0x1000c550
push str.Proxy_Server_Disabled
call esi
push str.http:__www.smartysoft.cn_softonline
push str.http:__www.smartysoft.com_softonline
call esi
push str.support_smartysoft.cn
push 0x1000dd90
call esi
mov edi, 0x1000c4c8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e190
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.www.smartysoft.cn
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4a0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e090
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c5bc
jmp 0x1000363f
push 0x1000c60c
push edi
call ebx
test eax, eax
jne 0x10003569
push 0x1000c480
push 0x1000e8e8
call esi
push 0x1000c474
push 0x1000e6e8
call esi
push str.vuMR
push str.OffLine_Now
call esi
push 0x1000c450
push 0x1000e3e4
call esi
push 0x1000c43c
push str.Proxy_Server_Disabled
call esi
push str.http:__www.smartysoft.net_softonline
push str.http:__www.smartysoft.com_softonline
call esi
push str.support_smartysoft.net
push 0x1000dd90
call esi
mov edi, 0x1000c4b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e190
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.www.smartysoft.cn
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4a0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e090
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c5b8
jmp 0x1000363f
push 0x1000c604
push edi
call ebx
test eax, eax
jne 0x1000365f
push 0x1000c3a0
push 0x1000e8e8
call esi
push 0x1000c388
push 0x1000e6e8
call esi
push 0x1000c370
push str.OffLine_Now
call esi
push 0x1000c348
push 0x1000e3e4
call esi
push 0x1000c31c
push str.Proxy_Server_Disabled
call esi
push 0x1000c2d0
push str.http:__www.smartysoft.com_softonline
call esi
push 0x1000c2a0
push 0x1000dd90
call esi
mov edi, 0x1000c4a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e190
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.www.smartysoft.cn
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c4b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000e090
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000c5b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x1000e290
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10002220
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push 0xffffffffffffffff
push ecx
push 0
push 0
call ebp
push 0
inc eax
push 0
push eax
push str.hostscan
lea edx, [esp + 0x34]
push 0xffffffffffffffff
push edx
push 0
push 0
call ebp
push 0
push 0
push 0
push 0
lea eax, [esp + 0x234]
push 0xffffffffffffffff
push eax
push 0
push 0
call ebp
push 0
inc eax
push 0
push eax
push 0x1000e5e4
lea ecx, [esp + 0x234]
push 0xffffffffffffffff
push ecx
push 0
push 0
call ebp
lea edx, [esp + 0x10]
push edx
push 0x1000e3b8
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [0x1000e3b4]
mov ecx, dword [0x1000d468]
push eax
push ecx
call fcn.100039c0
mov edx, dword [0x1000e3b4]
add esp, 8
mov dword [0x1000d988], eax
push 0x10003820
push 0xfffffffffffffffc
push edx
call dword [0x1000d460]
mov ecx, dword [0x1000e3b4]
mov dword [0x1000eae8], eax
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x438]
cmp esi, 0xa0
jge 0x1000372d
mov esi, 0xa0
mov ecx, dword [esp + 0x43c]
mov dword [0x1000e2a4], esi
cmp ecx, 0x28
jge 0x10003744
mov ecx, 0x28
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
test edi, edi
mov dword [0x1000d984], ecx
jne 0x1000375a
test eax, eax
je 0x100037d3
mov edx, dword [esp + 0x434]
cmp edx, 1
jne 0x10003776
push edx
mov edx, dword [0x1000d988]
push ecx
push esi
push 0
push 0
push edx
jmp 0x100037cd
cmp edx, 2
jne 0x10003786
push 1
push ecx
push esi
sub edi, esi
push 0
push edi
jmp 0x100037c7
cmp edx, 3
jne 0x1000379d
push 1
push ecx
sub eax, ecx
mov ecx, dword [0x1000d988]
push esi
push eax
push 0
push ecx
jmp 0x100037cd
push 1
cmp edx, 4
push ecx
push esi
jne 0x100037b5
mov edx, dword [0x1000d988]
sub eax, ecx
sub edi, esi
push eax
push edi
push edx
jmp 0x100037cd
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, edi
sub eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [0x1000d988]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x1000d988]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x1000d468]
push 0x1000d580
push 0
push edx
push 0x100031f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov dword [0x1000d478], eax
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x414
ret