Function at 0x1002ec90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x1012139c], 4
jne 0x1002ecc4
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002ecc4
push 0x1005e31c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ecc4
mov eax, 1
jmp 0x1002ef6b
cmp dword [ebp + 8], 0
jne 0x1002ecd1
xor eax, eax
jmp 0x1002ef6b
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
jne 0x1002ece2
xor eax, eax
jmp 0x1002ef6b
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x7e
jne 0x1002ecf4
xor eax, eax
jmp 0x1002ef6b
push str..tmp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ed0e
xor eax, eax
jmp 0x1002ef6b
mov ecx, dword [ebp + 8]
push ecx
call fcn.1003e420
add esp, 4
cmp eax, 4
ja 0x1002ed26
xor eax, eax
jmp 0x1002ef6b
push 0x1005e32c
mov edx, dword [ebp + 8]
push edx
call fcn.100070a0
add esp, 8
test eax, eax
je 0x1002ed42
xor eax, eax
jmp 0x1002ef6b
push str.RECYCLE
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ed5c
xor eax, eax
jmp 0x1002ef6b
push str._releasenotes.pdf
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ed76
xor eax, eax
jmp 0x1002ef6b
push str._temp
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ed90
xor eax, eax
jmp 0x1002ef6b
push str.pagefile.sys
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002edaa
xor eax, eax
jmp 0x1002ef6b
mov ecx, dword [0x1011c7dc]
and ecx, 0x4000000
je 0x1002ee8f
push str.PhysicalDrive
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002edfd
push str.DeviceHarddisk
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ee8f
push str.volumeshadowcopy
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002ee8f
push str.SVCHOST.EXE
push 0x1011f518
call fcn.10008290
add esp, 8
test eax, eax
jne 0x1002ee6a
push 0x10120550
call fcn.1003e420
add esp, 4
push eax
push 0x1011f118
push 0x10120550
call fcn.10008300
add esp, 0xc
test eax, eax
jne 0x1002ee6a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002ee6a
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
test eax, eax
je 0x1002ee6a
push str._k_localsystemnetworkrestricted
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ee6a
xor eax, eax
jmp 0x1002ef6b
push str.Samsung
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ee85
xor eax, eax
jmp 0x1002ef6b
mov eax, 4
jmp 0x1002ef6b
cmp dword [0x10107238], 0
je 0x1002eebe
cmp dword [0x10107238], 0xffffffff
je 0x1002eebe
mov edx, dword [ebp + 8]
push edx
call fcn.10015f30
add esp, 4
movzx eax, al
test eax, eax
je 0x1002eebe
mov eax, 2
jmp 0x1002ef6b
mov dword [ebp - 4], 0
push str..doc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002ef3d
push str..hwp
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002ef3d
push str..pdf
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002ef3d
push str..ppt
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002ef3d
push str..xls
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002ef44
mov eax, 1
jmp 0x1002ef6b
movsx eax, byte [0x1011fe50]
test eax, eax
je 0x1002ef69
push 0x1011fe50
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002ef69
mov eax, 1
jmp 0x1002ef6b
xor eax, eax
mov esp, ebp
pop ebp
ret