Function at 0x1002ec70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x1012139c], 4
jne 0x1002eca4
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002eca4
push 0x1005e31c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002eca4
mov eax, 1
jmp 0x1002ef4b
cmp dword [ebp + 8], 0
jne 0x1002ecb1
xor eax, eax
jmp 0x1002ef4b
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
jne 0x1002ecc2
xor eax, eax
jmp 0x1002ef4b
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x7e
jne 0x1002ecd4
xor eax, eax
jmp 0x1002ef4b
push str..tmp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ecee
xor eax, eax
jmp 0x1002ef4b
mov ecx, dword [ebp + 8]
push ecx
call fcn.1003e400
add esp, 4
cmp eax, 4
ja 0x1002ed06
xor eax, eax
jmp 0x1002ef4b
push 0x1005e32c
mov edx, dword [ebp + 8]
push edx
call fcn.100070a0
add esp, 8
test eax, eax
je 0x1002ed22
xor eax, eax
jmp 0x1002ef4b
push str.RECYCLE
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ed3c
xor eax, eax
jmp 0x1002ef4b
push str._releasenotes.pdf
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ed56
xor eax, eax
jmp 0x1002ef4b
push str._temp
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ed70
xor eax, eax
jmp 0x1002ef4b
push str.pagefile.sys
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ed8a
xor eax, eax
jmp 0x1002ef4b
mov ecx, dword [0x1011c7dc]
and ecx, 0x4000000
je 0x1002ee6f
push str.PhysicalDrive
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002eddd
push str.DeviceHarddisk
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ee6f
push str.volumeshadowcopy
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002ee6f
push str.SVCHOST.EXE
push 0x1011f518
call fcn.10008290
add esp, 8
test eax, eax
jne 0x1002ee4a
push 0x10120550
call fcn.1003e400
add esp, 4
push eax
push 0x1011f118
push 0x10120550
call fcn.10008300
add esp, 0xc
test eax, eax
jne 0x1002ee4a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002ee4a
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
test eax, eax
je 0x1002ee4a
push str._k_localsystemnetworkrestricted
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ee4a
xor eax, eax
jmp 0x1002ef4b
push str.Samsung
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ee65
xor eax, eax
jmp 0x1002ef4b
mov eax, 4
jmp 0x1002ef4b
cmp dword [0x10107238], 0
je 0x1002ee9e
cmp dword [0x10107238], 0xffffffff
je 0x1002ee9e
mov edx, dword [ebp + 8]
push edx
call fcn.10015f10
add esp, 4
movzx eax, al
test eax, eax
je 0x1002ee9e
mov eax, 2
jmp 0x1002ef4b
mov dword [ebp - 4], 0
push str..doc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002ef1d
push str..hwp
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002ef1d
push str..pdf
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002ef1d
push str..ppt
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002ef1d
push str..xls
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002ef24
mov eax, 1
jmp 0x1002ef4b
movsx eax, byte [0x1011fe50]
test eax, eax
je 0x1002ef49
push 0x1011fe50
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ef49
mov eax, 1
jmp 0x1002ef4b
xor eax, eax
mov esp, ebp
pop ebp
ret