Function at 0x10038db
Capabilities:
Get hostname
Query or enumerate registry value
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10133a4]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x64], esi
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0x1001698
xor ebx, ebx
push ebx
push ebx
mov edi, eax
mov dword [0x1013b74], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push ebx
push 1
push ebx
push ebx
mov dword [0x1013ba0], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
push esi
mov dword [0x1013f40], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
cmp eax, ebx
mov dword [0x1013b64], eax
jne 0x100394a
push 0x1001674
call fcn.0100eda2
pop ecx
jmp 0x1003e97
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x10
push dword [0x1013b74]
call esi
push 0x11
push dword [0x1013b74]
mov dword [0x10134c8], eax
call esi
push 0x12
push dword [0x1013b74]
mov dword [0x10134d0], eax
call esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push 4
push dword [0x1013b74]
mov dword [0x10134c0], eax
call esi
push 3
push dword [0x1013b74]
mov dword [0x1013a80], eax
call esi
push 5
push dword [0x1013b74]
mov dword [0x10140c4], eax
call esi
push 0xd
push dword [0x1013b74]
mov dword [0x1013838], eax
call esi
mov esi, dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [0x1013e04], eax
lea eax, [ebp - 0x58]
push eax
push 0x3c
push 0xd
call esi
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, edi
and eax, 0x3ff
cmp ax, 0x11
je 0x10039fa
cmp ax, 4
je 0x10039fa
cmp ax, 0x12
je 0x10039fa
mov byte [ebp - 0x41], 1
push 0x1001658
jmp 0x1003a02
mov byte [ebp - 0x41], bl
push 0x1001644
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
cmp eax, ebx
mov dword [0x1013b04], eax
jne 0x1003a28
push 0xd
call esi
mov dword [0x1013b04], eax
call fcn.01009882
cmp byte [0x10133c0], bl
jne 0x1003a75
push 0x100
mov edi, 0x10133c0
push edi
push 0x39
push dword [0x1013b74]
call dword [sym.imp.USER32.dll_LoadStringA]
xor esi, esi
cmp eax, ebx
jl 0x1003a6f
lea ecx, [esi + 0x10133c0]
mov dl, byte [ecx]
cmp dl, 1
jne 0x1003a65
xor edx, edx
jmp 0x1003a68
movsx edx, dl
inc esi
cmp esi, eax
mov byte [ecx], dl
jle 0x1003a54
mov dword [0x1014120], edi
push ebx
push ebx
push 0x100d39f
push 0x1013508
mov dword [0x1013834], ebx
call sub.USER32.dll_DdeInitializeA
mov esi, eax
cmp esi, ebx
je 0x1003ab3
push 0x1001624
call fcn.0100eda2
pop ecx
push 0x10
push 0x16
push esi
push ebx
push dword [0x1013b74]
call fcn.0100ad70
jmp 0x1003e97
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x1a]
push eax
mov byte [ebp - 0x1b], 0x5c
mov byte [ebp - 0x1c], 0x5c
mov dword [ebp - 0x6c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x100161c
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, 0x3ec
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [0x1013508]
call sub.USER32.dll_DdeCreateStringHandleA
push esi
push 0x1001614
push dword [0x1013508]
mov dword [0x1013844], eax
call sub.USER32.dll_DdeCreateStringHandleA
push esi
push 0x100160c
push dword [0x1013508]
mov dword [0x1013ac0], eax
call sub.USER32.dll_DdeCreateStringHandleA
push esi
push 0x1001600
push dword [0x1013508]
mov dword [0x1014130], eax
call sub.USER32.dll_DdeCreateStringHandleA
push esi
push str.CLPBK_
push dword [0x1013508]
mov dword [0x10139e8], eax
call sub.USER32.dll_DdeCreateStringHandleA
push esi
push 0x10015f0
push dword [0x1013508]
mov dword [0x1014184], eax
call sub.USER32.dll_DdeCreateStringHandleA
push dword [0x1013508]
mov dword [0x1013628], eax
call sub.USER32.dll_DdeGetLastError
test eax, eax
je 0x1003b80
push 0x10015d4
jmp 0x100393f
mov dword [0x1014134], 0x100a9c1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [0x1013b74]
push dword [0x1014134]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp eax, ebx
mov dword [0x10134c4], eax
jne 0x1003bb8
push 0x10015bc
jmp 0x100393f
push 0x80
mov esi, 0x1013d40
push esi
push 0x101
push dword [0x1013b74]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x68]
push eax
push 0x1013e8c
push ebx
push 0xb
push ebx
push ebx
push ebx
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1003c1e
push 0x10015a0
call fcn.0100eda2
xor esi, esi
inc esi
pop ecx
mov dword [0x1014128], esi
mov dword [0x1013e00], esi
mov dword [0x1013b7c], esi
mov dword [0x10139e0], ebx
jmp 0x1003ccd
push dword [ebp - 0x68]
mov dword [ebp - 0x5c], 4
push 0x100157c
call fcn.0100eda2
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
pop ecx
lea eax, [ebp - 0x5c]
push eax
push 0x1014128
push ebx
push ebx
push str.StatusBar
push dword [0x1013e8c]
call esi
test eax, eax
je 0x1003c60
mov dword [0x1014128], 1
lea eax, [ebp - 0x5c]
push eax
push 0x1013e00
push ebx
push ebx
push str.ToolBar
push dword [0x1013e8c]
call esi
test eax, eax
je 0x1003c86
mov dword [0x1013e00], 1
lea eax, [ebp - 0x5c]
push eax
push 0x1013b7c
push ebx
push ebx
push str.AutoShare
push dword [0x1013e8c]
call esi
test eax, eax
je 0x1003ca8
mov dword [0x1013b7c], ebx
lea eax, [ebp - 0x5c]
push eax
push 0x10139e0
push ebx
push ebx
push str.EnableShare
push dword [0x1013e8c]
call esi
xor esi, esi
inc esi
test eax, eax
je 0x1003ccd
mov dword [0x10139e0], esi
push esi
push ebx
push ebx
mov dword [0x1013018], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0x60], eax
je 0x1003d2b
push 4
push 0x1001568
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x5c], eax
je 0x1003d24
lea ecx, [ebp - 0x88]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1003d1f
cmp dword [ebp - 0x84], 4
jne 0x1003d1f
mov dword [0x1013018], esi
push dword [ebp - 0x5c]
call edi
push dword [ebp - 0x60]
call edi
jmp 0x1003d36
push 0x1001550
call fcn.0100eda2
pop ecx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
call sub.NETAPI32.dll_NetGetJoinInformation
test eax, eax
jne 0x1003d5c
cmp dword [ebp - 0x60], 3
je 0x1003d54
mov dword [0x1013018], ebx
push dword [ebp - 0x5c]
call sub.NETAPI32.dll_NetApiBufferFree
push ebx
call fcn.0100e620
push ebx
push dword [ebp - 0x64]
mov dword [0x101412c], eax
push ebx
push ebx
mov eax, 0x80000000
push eax
push eax
push eax
push eax
push 0x2cf0000
push 0x1013aa0
push str.ClipBookWClass
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [0x1013ba4], eax
jne 0x1003d9f
push 0x1001538
jmp 0x100393f
call fcn.010037d9
mov esi, dword [sym.imp.USER32.dll_GetMenu]
push 3
push dword [0x1013ba4]
call esi
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call edi
push ebx
push dword [0x1013ba4]
mov dword [0x101382c], eax
call esi
push eax
call edi
cmp dword [0x10139e0], ebx
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
mov edi, eax
jne 0x1003df3
push 1
push 0x18
push edi
call esi
push 1
push 0x24
push edi
call esi
push 1
push 0x1a
push edi
call esi
cmp dword [0x1013018], ebx
jne 0x1003e09
push 1
push 0x1e
push edi
call esi
push 1
push 0x1f
push edi
call esi
push dword [0x1013ba4]
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov esi, 0x1013e60
push esi
push 0x1013aa0
call fcn.01009ac6
test eax, eax
je 0x1003e5a
mov eax, dword [ebp + 8]
or dword [0x1013e74], 0xffffffff
or dword [0x1013e78], 0xffffffff
push esi
push dword [0x1013ba4]
mov dword [0x1013e68], eax
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push dword [0x1013ba4]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x1003e69
push dword [ebp + 8]
push dword [0x1013ba4]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [ebp - 0x64]
push ebx
push dword [0x1013ba4]
push ebx
push ebx
push ebx
push ebx
push 0x40000000
push 0x1013504
push str.CVdummy
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [0x1013e90], eax
jne 0x1003e9b
xor eax, eax
jmp 0x1003eeb
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 0x2b
mov edi, 0x111
push edi
push dword [0x1013ba4]
call esi
push dword [0x1013ba4]
call dword [sym.imp.USER32.dll_SetClipboardViewer]
push ebx
push 0x19
push edi
push dword [0x1013ba4]
mov dword [0x10134e8], eax
call esi
push dword [0x1013ba4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [0x1013018], ebx
je 0x1003ee8
call fcn.0100c6b5
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100ec8a
leave
ret 4