Function at 0x1003c92c
Capabilities:
Create thread

Disassembly:
sub esp, 0x408
mov eax, dword [0x10074bac]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
mov esi, dword [esp + 0x410]
mov dword [esp + 4], esi
call fcn.10055630
test eax, eax
je 0x1003c95d
xor eax, eax
inc eax
jmp 0x1003cee3
mov eax, dword [esp + 0x414]
push ebx
push ebp
xor ebp, ebp
sub eax, ebp
push edi
je 0x1003ce2a
dec eax
je 0x1003c992
dec eax
je 0x1003c986
dec eax
jne 0x1003ce63
push esi
call fcn.1003c279
jmp 0x1003c98c
push esi
call fcn.1003c242
pop ecx
jmp 0x1003cee0
push 0x1003c8f2
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.1003c417
cmp eax, 0x600
mov dword [0x10072cd8], eax
jge 0x1003c9b6
mov dword [0x10141c2c], ebp
jmp 0x1003c9d3
push ebp
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call fcn.1003d897
add esp, 0x10
mov dword [0x10141c2c], eax
mov dword [0x102bc550], esi
call fcn.1003c46c
call fcn.10027aba
mov dword [0x10074b74], eax
cmp eax, 0x89578da3
jne 0x1003cdf2
call fcn.1003c51f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.100291b0
test eax, eax
setne al
pop ecx
mov byte [0x102bc54a], al
mov byte [0x10074b70], 1
call fcn.1002d6c6
or byte [0x102bc549], al
cmp dword [0x101434ac], ebp
je 0x1003ca3f
movzx eax, byte [0x102bc549]
push eax
push str.This_is_a_g_bMetro__d_
push ebp
call fcn.1003dfed
add esp, 0xc
mov ebx, dword [0x10072cc4]
cmp ebx, ebp
jne 0x1003ca54
mov ebx, 0x111111
mov dword [0x10072cc4], ebx
mov eax, dword [0x10140308]
mov esi, dword [0x10144688]
xor edx, edx
inc edx
mov ecx, closesocket
cmp eax, edx
jne 0x1003ca7a
test ecx, esi
jne 0x1003ca8e
mov ebx, 0x222222
mov dword [0x10072cc4], ebx
cmp eax, 2
jne 0x1003ca8e
test ecx, esi
jne 0x1003ca8e
mov ebx, 0xaaaaaa
mov dword [0x10072cc4], ebx
mov eax, dword [0x10072cd8]
mov edi, 0x602
lea esi, [edi - 1]
cmp eax, esi
lea ecx, [edi + 1]
mov ebp, 0x500
jg 0x1003cb81
cmp eax, 0x600
jge 0x1003cb62
cmp eax, ebp
je 0x1003cada
lea ebx, [eax - 0x501]
cmp ebx, edx
ja 0x1003cada
cmp byte [0x10074b70], 0
mov edx, dword [0x10072cc4]
je 0x1003cb5a
and edx, 0xf
mov dword [0x102bc54c], edx
cmp dword [0x101434ac], 0
je 0x1003cd2e
cmp eax, esi
mov ebx, 0x40000000
jg 0x1003cc12
cmp eax, 0x600
jge 0x1003cbc1
cmp eax, ebp
je 0x1003cbab
lea ecx, [eax - 0x501]
cmp ecx, 1
ja 0x1003cc4d
test dword [0x1015bd84], ebx
je 0x1003cc5e
cmp eax, 0x502
jne 0x1003cb45
lea eax, [esp + 0x14]
push str.OS_2003
push eax
call fcn.100074d8
mov eax, dword [0x10072cd8]
pop ecx
pop ecx
cmp eax, 0x501
jne 0x1003cc5e
push str.OS_XP
jmp 0x1003cc52
shr edx, 4
jmp 0x1003cad7
cmp byte [0x10074b70], 0
je 0x1003cb70
shr ebx, 8
jmp 0x1003cb73
shr ebx, 0xc
and ebx, 0xf
mov dword [0x102bc54c], ebx
jmp 0x1003cae0
cmp eax, edi
jl 0x1003cada
cmp eax, ecx
jle 0x1003cb98
cmp eax, 0xa00
jne 0x1003cada
cmp byte [0x10074b70], 0
je 0x1003cba6
shr ebx, 0x10
jmp 0x1003cb73
shr ebx, 0x14
jmp 0x1003cb73
test dword [0x1015bd84], ebx
je 0x1003cc5e
push str.OS_2000
jmp 0x1003cc52
test dword [0x1015bd84], ebx
je 0x1003cc5e
cmp eax, 0x600
jne 0x1003cc07
lea eax, [esp + 0x14]
push str.OS_VISTA
push eax
call fcn.100074d8
mov eax, dword [0x10072cd8]
pop ecx
pop ecx
cmp eax, 0x600
jne 0x1003cc07
lea eax, [esp + 0x14]
push str.OS_2008
push eax
call fcn.100074d8
mov eax, dword [0x10072cd8]
pop ecx
pop ecx
cmp eax, esi
jne 0x1003cc5e
push str.OS_7
jmp 0x1003cc52
cmp eax, edi
jl 0x1003cc4d
cmp eax, ecx
jle 0x1003cc21
cmp eax, 0xa00
jne 0x1003cc4d
test dword [0x1015bd84], ebx
je 0x1003cc5e
cmp eax, edi
jne 0x1003cc5e
lea eax, [esp + 0x14]
push str.OS_8
push eax
call fcn.100074d8
pop ecx
pop ecx
cmp dword [0x10072cd8], edi
jne 0x1003cc5e
push str.OS_2012
jmp 0x1003cc52
push str.Unknown
lea eax, [esp + 0x18]
push eax
call fcn.100074d8
pop ecx
pop ecx
mov edi, str.32bit_WoW_App
test dword [0x1015bd84], ebx
je 0x1003cce8
cmp dword [0x10144ec4], 0
je 0x1003cce8
mov al, byte [0x102bc54c]
test al, 1
je 0x1003cc84
mov esi, 0x1006c18c
jmp 0x1003cc9d
test al, 2
je 0x1003cc8f
mov esi, 0x1006c188
jmp 0x1003cc9d
mov esi, 0x1006c184
test al, 4
jne 0x1003cc9d
mov esi, str.UnKnown
cmp byte [0x10074b70], 0
je 0x1003ccc2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.100291b0
pop ecx
test eax, eax
je 0x1003ccbb
mov eax, edi
jmp 0x1003ccc7
mov eax, str.32bit_____App
jmp 0x1003ccc7
mov eax, str.64bit_____App
push esi
push 0x10142848
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x224]
push str._s__s__s__s_
push eax
call fcn.10040b98
add esp, 0x18
cmp byte [0x10074b70], 0
je 0x1003cd0d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.100291b0
pop ecx
test eax, eax
je 0x1003cd06
mov eax, edi
jmp 0x1003cd12
mov eax, str.32bit_App
jmp 0x1003cd12
mov eax, str.64bit_App
push dword [0x10072cc4]
push dword [0x102bc54c]
push eax
push str.This_is_a__s___Engine__d_g_tc_Engine_0x_08x_
push 0
call fcn.1003dfed
add esp, 0x14
mov eax, dword [0x10144ef4]
mov ecx, eax
and ecx, 0x80
je 0x1003cd44
test eax, 0x40000
jne 0x1003cd4f
test ecx, ecx
jne 0x1003cd53
test eax, 0x4000000
je 0x1003cd53
mov bl, 1
jmp 0x1003cd55
xor bl, bl
xor ebp, ebp
cmp dword [0x102a851c], ebp
jne 0x1003cdbe
test dword [0x10144688], 0x400
jne 0x1003cdbe
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x1005f670
mov edi, 0x10142448
push edi
call esi
test eax, eax
jne 0x1003cdbe
push 0x10066620
push edi
call esi
test eax, eax
jne 0x1003cdbe
push 0x10066614
push edi
call esi
test eax, eax
jne 0x1003cdbe
push 0x10066608
push edi
call esi
test eax, eax
jne 0x1003cdbe
push 0x100665fc
push edi
call esi
test eax, eax
jne 0x1003cdbe
push 0x100665f0
push edi
call esi
test eax, eax
je 0x1003cdc0
mov bl, 1
test bl, bl
je 0x1003cdd2
push dword [esp + 0x10]
call fcn.1003c34a
jmp 0x1003ce63
lea eax, [esp + 0x10]
push eax
push ebp
push dword [esp + 0x18]
push fcn.1003c34a
push ebp
push ebp
call fcn.10041127
add esp, 0x18
mov dword [0x10092cd4], eax
jmp 0x1003ce63
cmp eax, 0x23785289
jne 0x1003ce0d
cmp dword [0x101434ac], ebp
je 0x1003ce63
push 0x10064f70
push str.found_OK_NOBHKOK__s_
jmp 0x1003ce1f
cmp dword [0x101434ac], ebp
je 0x1003ce63
push 0x10064f70
push str.Cannot_found_ME_______s___perfectly_ridiculous.
push ebp
call fcn.1003dfed
add esp, 0xc
jmp 0x1003ce63
mov eax, dword [0x101434ac]
mov edi, 0x99
lea esi, [edi - 2]
cmp eax, esi
je 0x1003ce3f
cmp eax, edi
jne 0x1003ce4c
push str.DLL_PROCESS_DETACH_start
push ebp
call fcn.1003dfed
pop ecx
pop ecx
push 0x1003c8f2
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp dword [0x10074b74], 0x89578da3
je 0x1003ce68
xor eax, eax
inc eax
jmp 0x1003cee0
mov eax, dword [0x101434ac]
cmp eax, esi
je 0x1003ce75
cmp eax, edi
jne 0x1003ce88
push 0x10142848
push str.ProcessDetach:__s
push ebp
call fcn.1003dfed
add esp, 0xc
call fcn.1003c5ad
push dword [esp + 0x10]
call fcn.1002797a
test eax, eax
setne bl
xor esi, esi
pop ecx
cmp dword [0x101434ac], esi
je 0x1003cebc
xor eax, eax
test bl, bl
sete al
push eax
push str.DetachDetours_ENDsuccess__d_
push esi
call fcn.1003dfed
add esp, 0xc
push esi
push str.tc_Scr
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
call fcn.1003e718
add esp, 0x10
call fcn.1000c97a
xor eax, eax
test bl, bl
sete al
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x408]
pop esi
xor ecx, esp
call fcn.1004083f
add esp, 0x408
ret 0xc