Function at 0x1003fad9
Capabilities:
Create thread

Disassembly:
sub esp, 0x40c
mov eax, dword [0x10083adc]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [esp + 0x414]
mov dword [esp + 8], ebx
call fcn.10059a80
test eax, eax
je 0x1003fb0a
xor eax, eax
inc eax
jmp 0x10040189
mov eax, dword [esp + 0x418]
push ebp
xor ebp, ebp
sub eax, ebp
push esi
push edi
je 0x100400dd
dec eax
je 0x1003fb3f
dec eax
je 0x1003fb33
dec eax
jne 0x10040117
push ebx
call fcn.1003f3ff
jmp 0x1003fb39
push ebx
call fcn.1003f3c8
pop ecx
jmp 0x10040186
push 0x1003fad4
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x102d2da8], eax
call fcn.1003f5c1
cmp eax, 0x600
mov dword [0x10077cd8], eax
jge 0x1003fb68
mov dword [0x10153a10], ebp
jmp 0x1003fb85
push ebp
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call fcn.10040c17
add esp, 0x10
mov dword [0x10153a10], eax
mov dword [0x102d2d9c], ebx
call fcn.1003f616
call fcn.1002d88b
mov esi, eax
cmp esi, ebp
je 0x1003fbee
push 0x200
lea eax, [esp + 0x1c]
push eax
push 0x8f
push dword [0x102d2d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x220]
push str._s_Stack_Size__d_Bytes
push eax
call fcn.10044ec8
lea eax, [esp + 0x228]
push eax
push str.StackOver......Except_OK__s_
push ebp
call fcn.1004122a
add esp, 0x1c
mov eax, 0x23785289
jmp 0x10040186
call fcn.100209d0
mov dword [0x10083694], eax
cmp eax, 0x89578da3
jne 0x100400a5
call fcn.1003f74c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1002c3f8
test eax, eax
setne al
pop ecx
mov byte [0x102d2d94], al
mov byte [0x10083690], 1
call fcn.10030ef2
or byte [0x102d2d93], al
cmp dword [0x10077cc4], ebp
jne 0x1003fc43
mov dword [0x10077cc4], 0x111111
test dword [0x1015086c], 0x40000000
je 0x1003fc56
call fcn.10026a65
jmp 0x1003fc8c
mov eax, dword [0x10151ce0]
mov edx, dword [0x1015686c]
mov ecx, bind
cmp eax, 1
jne 0x1003fc79
test ecx, edx
jne 0x1003fc8c
mov dword [0x10077cc4], 0x222222
cmp eax, 2
jne 0x1003fc8c
test ecx, edx
jne 0x1003fc8c
mov dword [0x10077cc4], 0xaaaaaa
mov eax, dword [0x10077cd8]
mov bl, byte [0x10083690]
mov edi, 0x602
lea esi, [edi - 1]
cmp eax, esi
lea ecx, [edi + 1]
mov edx, 0xa00
mov ebp, 0x500
jg 0x1003fd1d
cmp eax, 0x600
jge 0x1003fcec
cmp eax, ebp
je 0x1003fd51
lea ebx, [eax - 0x501]
cmp ebx, 1
ja 0x1003fd51
cmp byte [0x10083690], 0
mov ebx, dword [0x10077cc4]
jne 0x1003fd12
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 4
mov ebx, dword [esp + 0x10]
jmp 0x1003fd12
test bl, bl
mov ebx, dword [0x10077cc4]
je 0x1003fd05
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 8
mov ebx, dword [esp + 0x10]
jmp 0x1003fd12
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 0xc
mov ebx, dword [esp + 0x10]
and ebx, 0xf
mov dword [0x102d2d98], ebx
jmp 0x1003fd5b
cmp eax, edi
jl 0x1003fd51
cmp eax, ecx
jle 0x1003fd29
cmp eax, edx
jne 0x1003fd51
test bl, bl
mov ebx, dword [0x10077cc4]
je 0x1003fd42
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 0x10
mov ebx, dword [esp + 0x10]
jmp 0x1003fd12
mov dword [esp + 0x10], ebx
shr dword [esp + 0x10], 0x14
mov ebx, dword [esp + 0x10]
jmp 0x1003fd12
mov dword [0x102d2d98], 1
cmp dword [0x1015568c], 0
je 0x1003ff5a
cmp eax, esi
jg 0x1003fe37
mov edi, 0x600
cmp eax, edi
jge 0x1003fde8
cmp eax, ebp
je 0x1003fdce
lea ecx, [eax - 0x501]
cmp ecx, 1
ja 0x1003fe73
test dword [0x1016ed68], 0x40000000
je 0x1003fe84
cmp eax, 0x502
jne 0x1003fdb9
lea eax, [esp + 0x18]
push str.OS_2003
push eax
call fcn.1000789a
mov eax, dword [0x10077cd8]
pop ecx
pop ecx
cmp eax, 0x501
jne 0x1003fe84
push str.OS_XP
jmp 0x1003fe78
test dword [0x1016ed68], 0x40000000
je 0x1003fe84
push str.OS_2000
jmp 0x1003fe78
test dword [0x1016ed68], 0x40000000
je 0x1003fe84
cmp eax, edi
jne 0x1003fe2c
lea eax, [esp + 0x18]
push str.OS_VISTA
push eax
call fcn.1000789a
mov eax, dword [0x10077cd8]
pop ecx
pop ecx
cmp eax, edi
jne 0x1003fe2c
lea eax, [esp + 0x18]
push str.OS_2008
push eax
call fcn.1000789a
mov eax, dword [0x10077cd8]
pop ecx
pop ecx
cmp eax, esi
jne 0x1003fe84
push str.OS_7
jmp 0x1003fe78
cmp eax, edi
jl 0x1003fe73
cmp eax, ecx
jle 0x1003fe43
cmp eax, edx
jne 0x1003fe73
test dword [0x1016ed68], 0x40000000
je 0x1003fe84
cmp eax, edi
jne 0x1003fe84
lea eax, [esp + 0x18]
push str.OS_8
push eax
call fcn.1000789a
pop ecx
pop ecx
cmp dword [0x10077cd8], edi
jne 0x1003fe84
push str.OS_2012
jmp 0x1003fe78
push str.Unknown
lea eax, [esp + 0x1c]
push eax
call fcn.1000789a
pop ecx
pop ecx
xor ebx, ebx
test dword [0x1016ed68], 0x40000000
mov edi, str.32bit_WoW_App
je 0x1003ff13
cmp dword [0x10156ca4], ebx
je 0x1003ff13
mov al, byte [0x102d2d98]
test al, 1
je 0x1003feaf
mov esi, 0x10070e8c
jmp 0x1003fec8
test al, 2
je 0x1003feba
mov esi, 0x10070e88
jmp 0x1003fec8
mov esi, 0x10070e84
test al, 4
jne 0x1003fec8
mov esi, str.UnKnown
cmp byte [0x10083690], 0
je 0x1003feed
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1002c3f8
pop ecx
test eax, eax
je 0x1003fee6
mov eax, edi
jmp 0x1003fef2
mov eax, str.32bit_____App
jmp 0x1003fef2
mov eax, str.64bit_____App
push esi
push 0x10154a28
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x228]
push str._s__s__s__s_
push eax
call fcn.10044ec8
add esp, 0x18
cmp byte [0x10083690], 0
je 0x1003ff38
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1002c3f8
pop ecx
test eax, eax
je 0x1003ff31
mov eax, edi
jmp 0x1003ff3d
mov eax, str.32bit_App
jmp 0x1003ff3d
mov eax, str.64bit_App
push dword [0x10077cc4]
push dword [0x102d2d98]
push eax
push str.This_is_a__s___Engine__d_g_tc_Engine_0x_08x_
push ebx
call fcn.1004122a
add esp, 0x14
jmp 0x1003ff5c
xor ebx, ebx
cmp dword [0x102bed64], ebx
jne 0x1003ffcf
test dword [0x1015686c], 0x400
jne 0x1003ffcf
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x10063b0c
mov edi, 0x10154228
push edi
call esi
test eax, eax
jne 0x1003ffcf
push 0x1006b988
push edi
call esi
test eax, eax
jne 0x1003ffcf
push 0x1006b97c
push edi
call esi
test eax, eax
jne 0x1003ffcf
push 0x1006b970
push edi
call esi
test eax, eax
jne 0x1003ffcf
push 0x1006b964
push edi
call esi
test eax, eax
jne 0x1003ffcf
push 0x1006b958
push edi
call esi
test eax, eax
jne 0x1003ffcf
push 0x10063a50
push edi
call esi
test eax, eax
je 0x1003ffd6
mov byte [0x102d2d90], 1
cmp dword [0x1015568c], ebx
je 0x10040004
movzx eax, byte [0x102d2d91]
push eax
movzx eax, byte [0x102d2d90]
push eax
movzx eax, byte [0x102d2d93]
push eax
push str.This_is_a_g_bMetro__d_g_bRansomHigh__d_g_bRansomHighest__d_
push ebx
call fcn.1004122a
add esp, 0x14
mov esi, str.express_zip_file_compression
cmp byte [esi], 0
je 0x10040042
cmp esi, str.This_is_a_g_bMetro__d_g_bRansomHigh__d_g_bRansomHighest__d_
jae 0x10040042
push esi
push 0x10153168
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1004003f
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004002c
sub eax, ecx
lea esi, [esi + eax + 1]
cmp esi, ebx
jne 0x10040009
jmp 0x10040042
or esi, 0xffffffff
cmp byte [0x102d2d90], 0
je 0x10040085
cmp esi, 0xffffffff
je 0x10040085
push str.tasklist.exe
mov esi, 0x10154628
push esi
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10040085
push str.firefox.exe
push esi
call fcn.10007795
pop ecx
pop ecx
test eax, eax
je 0x10040085
push dword [esp + 0x14]
call fcn.1003f4d0
jmp 0x10040117
lea eax, [esp + 0x14]
push eax
push ebx
push dword [esp + 0x1c]
push fcn.1003f4d0
push ebx
push ebx
call fcn.1004547d
add esp, 0x18
mov dword [0x100a1bf4], eax
jmp 0x10040117
cmp eax, 0x23785289
jne 0x100400c0
cmp dword [0x1015568c], ebp
je 0x10040117
push 0x100686bc
push str.found_OK_NOBHKOK__s_
jmp 0x100400d2
cmp dword [0x1015568c], ebp
je 0x10040117
push 0x100686bc
push str.Cannot_found_ME_______s___perfectly_ridiculous.
push ebp
call fcn.1004122a
add esp, 0xc
jmp 0x10040117
mov eax, dword [0x1015568c]
mov edi, 0x99
lea esi, [edi - 2]
cmp eax, esi
je 0x100400f2
cmp eax, edi
jne 0x100400ff
push str.DLL_PROCESS_DETACH_start
push ebp
call fcn.1004122a
pop ecx
pop ecx
push dword [0x102d2da8]
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp dword [0x10083694], 0x89578da3
je 0x1004011c
xor eax, eax
inc eax
jmp 0x10040186
mov eax, dword [0x1015568c]
cmp eax, esi
je 0x10040129
cmp eax, edi
jne 0x1004013c
push 0x10154a28
push str.ProcessDetach:__s
push ebp
call fcn.1004122a
add esp, 0xc
push ebx
call fcn.1001e2bc
test eax, eax
pop ecx
setne bl
call fcn.1003f7da
cmp dword [0x1015568c], ebp
je 0x1004016b
xor eax, eax
test bl, bl
sete al
push eax
push str.DetachDetours_ENDsuccess__d_
push ebp
call fcn.1004122a
add esp, 0xc
push ebp
push str.tc_Scr
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
call fcn.10041961
add esp, 0x10
movzx eax, bl
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40c]
pop ebx
xor ecx, esp
call fcn.10044b6f
add esp, 0x40c
ret 0xc