Function at 0x1003b0ab
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2d98]
mov eax, 0x2e18
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x2d94], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x70], ecx
cmp dword [ebp + 0x2dac], ebx
jne 0x1003b0df
xor eax, eax
jmp 0x1003b56a
cmp dword [0x10144694], 2
mov eax, dword [ebp + 0x2da0]
push esi
push 0x48
mov dword [ebp - 0x74], eax
pop esi
je 0x1003b0fe
test byte [0x1013dc28], 1
je 0x1003b101
mov dword [ebp - 0x74], esi
test byte [ebp - 0x74], 1
je 0x1003b126
cmp byte [0x10149960], bl
je 0x1003b126
push 0x10142848
push 0x10149960
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b126
mov dword [ebp - 0x74], esi
cmp dword [0x101434ac], 0x64
jne 0x1003b152
push dword [ebp + 0x2dac]
push dword [ebp + 0x2da8]
push dword [ebp + 0x2da4]
push dword [ebp - 0x74]
push str.SendInfoDisplay:_d:_d:_d:_d
push ebx
call fcn.1003dfed
add esp, 0x18
push edi
mov esi, 0x1ff
push esi
lea eax, [ebp + 0x2595]
push ebx
push eax
mov byte [ebp + 0x2594], bl
call fcn.10040850
push esi
lea eax, [ebp + 0x2795]
push ebx
push eax
mov byte [ebp + 0x2794], bl
call fcn.10040850
push 0xdff
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.10040850
mov edi, 0x9ff
push edi
lea eax, [ebp + 0xd95]
push ebx
push eax
mov byte [ebp + 0xd94], bl
call fcn.10040850
push edi
lea eax, [ebp + 0x1795]
push ebx
push eax
mov byte [ebp + 0x1794], bl
call fcn.10040850
mov eax, dword [0x1029e3fc]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x2594]
push str.SoftWareTrojanCut_td_DDXP
push eax
mov edi, edx
add edi, 0x64
inc dword [0x1029e3fc]
mov dword [ebp - 0x78], edi
call fcn.10040b98
add esp, 0x44
push edi
lea eax, [ebp + 0x2794]
push 0x1005d13c
push eax
call fcn.10040b98
push esi
lea eax, [ebp + 0x2b95]
push ebx
push eax
mov byte [ebp + 0x2b94], bl
call fcn.10040850
lea eax, [ebp - 0x80]
push eax
call fcn.10040fd5
lea eax, [ebp - 0x80]
push eax
call fcn.10040fae
add esp, 0x20
cmp eax, ebx
je 0x1003b249
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x2b94]
push 0x200
push eax
call fcn.10041c5f
add esp, 0x10
jmp 0x1003b25c
lea eax, [ebp + 0x2b94]
push str.0000
push eax
call fcn.100074d8
pop ecx
pop ecx
test byte [0x10072cc8], 2
je 0x1003b37d
lea eax, [ebp + 0xd94]
push 0xa00
push eax
call fcn.100317d6
push esi
lea eax, [ebp + 0x2995]
push ebx
push eax
mov byte [ebp + 0x2994], bl
call fcn.10040850
mov esi, dword [ebp - 0x70]
lea eax, [ebp + 0x2994]
push eax
add esi, 0x78c
push esi
call fcn.1003d99e
add esp, 0x1c
cmp byte [0x1029dff0], bl
je 0x1003b2c2
mov eax, 0x1029dff0
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003b2b8
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.rundll32.exe
push esi
call edi
test eax, eax
jne 0x1003b31c
push 0x10063b10
push esi
call edi
test eax, eax
jne 0x1003b31c
push str.svchost.exe
push esi
call edi
test eax, eax
jne 0x1003b31c
lea eax, [ebp + 0xd94]
push eax
lea eax, [ebp + 0x2994]
push eax
push esi
call fcn.10007344
pop ecx
push eax
push esi
lea eax, [ebp + 0x1794]
push str._s__d__s__s
push eax
call fcn.10040b98
add esp, 0x18
jmp 0x1003b3bc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp + 0x2194]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x1003b328
lea eax, [ebp + 0x2194]
push 0x20
push eax
call fcn.10040730
pop ecx
pop ecx
cmp eax, ebx
jne 0x1003b34e
lea eax, [ebp + 0x2194]
jmp 0x1003b34f
inc eax
lea ecx, [ebp + 0xd94]
push ecx
push eax
lea eax, [ebp + 0x2994]
push eax
push esi
call fcn.10007344
pop ecx
push eax
push esi
lea eax, [ebp + 0x1794]
push str._s__d__s__s_0___s
push eax
call fcn.10040b98
add esp, 0x1c
jmp 0x1003b3bc
cmp byte [0x1029dff0], bl
je 0x1003b39f
mov edx, dword [ebp - 0x70]
mov eax, 0x1029dff0
add edx, 0x78c
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003b395
mov eax, dword [ebp - 0x70]
add eax, 0x78c
push eax
lea eax, [ebp + 0x1794]
push eax
call fcn.100074d8
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
pop ecx
pop ecx
push str._fdrv_
lea eax, [ebp + 0x1794]
push eax
call edi
test eax, eax
jne 0x1003b4e8
mov eax, dword [ebp - 0x70]
push dword [eax + 0x780]
lea ecx, [eax + 0x580]
push ecx
add eax, 0x380
push eax
lea eax, [ebp + 0x1794]
push eax
lea eax, [ebp + 0x2b94]
push eax
push dword [ebp + 0x2dac]
lea eax, [ebp - 0x6c]
push dword [ebp + 0x2da8]
push dword [ebp + 0x2da4]
push dword [ebp - 0x74]
push str._d_d_d_d_s_s_s_s_d
push eax
call fcn.10040b98
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2794]
push eax
lea eax, [ebp + 0x2594]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.1003ef27
add esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.1003e718
add esp, 0x10
cmp dword [0x101434ac], 0x64
jne 0x1003b469
push str.SendInfoDisplay_1
push ebx
call fcn.1003dfed
pop ecx
pop ecx
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push 0x1005d094
push ebx
call edi
mov dword [ebp - 0x70], eax
cmp eax, ebx
jne 0x1003b4a8
push 0x1005d094
push ebx
call edi
mov dword [ebp - 0x70], eax
cmp eax, ebx
jne 0x1003b4a8
push ebx
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push esi
call fcn.1003d897
add esp, 0x10
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x1003b4c8
test byte [ebp - 0x74], 1
push ebx
push dword [ebp - 0x78]
push 0xd60
push dword [ebp - 0x70]
je 0x1003b4c2
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1003b4c8
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x101434ac], 0x64
jne 0x1003b4e2
push dword [ebp - 0x70]
push str.SendInfoDisplay_2__d
push ebx
call fcn.1003dfed
add esp, 0xc
test byte [ebp - 0x74], 0x40
je 0x1003b4ec
xor eax, eax
jmp 0x1003b568
cmp dword [0x101446a4], 1
jne 0x1003b565
test byte [ebp - 0x74], 8
je 0x1003b565
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x101434ac], 0x64
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jne 0x1003b523
call esi
push eax
push str.ExitProcess___d_
push ebx
call fcn.1003dfed
add esp, 0xc
push 0x100612cc
push 0x10142448
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b54a
cmp dword [0x10072cd8], 0x501
jl 0x1003b54a
call fcn.10011dde
jmp 0x1003b565
test byte [0x102bc54c], 2
je 0x1003b55b
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call esi
push eax
call dword [0x10170374]
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp + 0x2d94]
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x2d98
leave
ret 0x10