Function at 0x1003ec10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf5c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0xf58], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1003f75e
test ebx, ebx
je 0x1003ec53
push 0x77c
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x1003f75e
push 0x3f
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.100d4cc0
add esp, 0xc
push 0x73c
lea ecx, [esp + 0x54]
push 0
push ecx
call fcn.100d4cc0
add esp, 0xc
cmp dword [0x101d36ac], 0
mov byte [0x101dd380], 0
je 0x1003edd9
xor edx, edx
push 0x7ce
push edx
lea eax, [esp + 0x79a]
push eax
mov dword [0x101d36ac], 0
mov word [esp + 0x79c], dx
call fcn.100d4cc0
add esp, 0xc
push 0x101d9c20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.1002c0c0
lea eax, [esp + 0x790]
mov esi, edi
mov ecx, eax
mov edx, 0x7d0
sub esi, ecx
lea ecx, [ecx]
lea ecx, [edx + 0x7ffff82e]
test ecx, ecx
je 0x1003ed00
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003ed00
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1003ece0
jmp 0x1003ed04
test edx, edx
jne 0x1003ed07
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x790]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x790]
call fcn.1002cd60
lea eax, [esp + 0x790]
call fcn.10034c90
call fcn.10022e40
call fcn.10035500
test al, al
jne 0x1003ed4d
call fcn.1002dab0
test eax, eax
je 0x1003edd9
cmp dword [0x101e2c9c], 0
jne 0x1003ed68
mov ecx, 0x1df
mov esi, 0x101e240c
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
jmp 0x1003ed72
lea ecx, [esp + 0x10]
push ecx
call fcn.10035790
test ebx, ebx
je 0x1003ed83
mov ecx, 0x1df
lea esi, [esp + 0x10]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x10]
push edx
call fcn.100237a0
add esp, 4
test al, al
je 0x1003edbd
mov dword [0x101e2cc0], 1
call fcn.100230d0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
call fcn.100230d0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp dword [0x101e2cc0], 0
je 0x1003ee32
cmp dword [0x101e2c9c], 0
jne 0x1003edfd
mov ecx, 0x1df
mov esi, 0x101e240c
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
jmp 0x1003ee07
lea eax, [esp + 0x10]
push eax
call fcn.10035790
test ebx, ebx
je 0x1003ee18
mov ecx, 0x1df
lea esi, [esp + 0x10]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.10043f00
cmp eax, 0x5d
jne 0x1003ee86
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.BeepRansomware
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.BeepRansomware
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x5b
jne 0x1003eed3
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.SatanV2
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.SatanV2
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x5a
jne 0x1003ef20
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push 0x1012f0b4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x1012f0b4
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x59
jne 0x1003ef71
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.Paradise
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Paradise
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x58
jne 0x1003efc2
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.Thanato
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Thanato
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x57
jne 0x1003f013
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.LockZip
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.LockZip
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x56
jne 0x1003f064
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.Ransomcrypt
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Ransomcrypt
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x55
jne 0x1003f0b5
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.WoodRansomware
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.WoodRansomware
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x54
jne 0x1003f106
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.BookNishRansomware
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.BookNishRansomware
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x53
jne 0x1003f157
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.LockDotRansomware
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.LockDotRansomware
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x52
jne 0x1003f1a8
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.AutoitRansomware
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.AutoitRansomware
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x51
jne 0x1003f1f9
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.PubgRansomware
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.PubgRansomware
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x50
jne 0x1003f24a
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.LimeRansomware
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.LimeRansomware
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x4f
jne 0x1003f29b
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.BansomQara
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.BansomQara
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x42
jne 0x1003f2ec
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.ZONGQING
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.ZONGQING
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x40
jne 0x1003f33d
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.CRYPT
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.CRYPT
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x41
jne 0x1003f38e
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.CRYSIS
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.CRYSIS
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x43
jne 0x1003f3df
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.Crypt888
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Crypt888
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x49
jne 0x1003f430
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.HelloEnCrypt
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.HelloEnCrypt
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x4a
jne 0x1003f481
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.ALLCry
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.ALLCry
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x4b
jne 0x1003f4d2
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push 0x1012f19c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x1012f19c
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x4e
jne 0x1003f523
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.CrandCrab
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.CrandCrab
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x4c
jne 0x1003f574
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.XiaoBa
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.XiaoBa
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x4d
jne 0x1003f5c5
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.XiaoBasb
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.XiaoBasb
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x20
jne 0x1003f616
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.TESLA
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.TESLA
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x46
jne 0x1003f667
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.noobcrypt3
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.noobcrypt3
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x45
jne 0x1003f6b8
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.HiddenTearsV1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.HiddenTearsV1
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x48
jne 0x1003f709
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.MCR4Ever
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.MCR4Ever
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
cmp eax, 0x47
jne 0x1003edc2
test ebx, ebx
je 0x1003ee6c
push 0x77c
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push str.petya
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.petya
push ebx
call fcn.100d4950
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf58]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xf64]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.100d0738
mov esp, ebp
pop ebp
ret