Function at 0x1003e225
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2d98]
mov eax, 0x2e18
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x2d94], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x70], ecx
cmp dword [ebp + 0x2dac], ebx
jne 0x1003e259
xor eax, eax
jmp 0x1003e78f
push esi
mov esi, str.messenger
cmp byte [esi], bl
je 0x1003e40a
cmp esi, str.IsPass_9
jae 0x1003e40a
push esi
push 0x10154168
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1003e407
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003e28d
sub eax, edx
lea esi, [esi + eax + 1]
cmp esi, ebx
jne 0x1003e25f
cmp dword [0x10157874], 2
mov eax, dword [ebp + 0x2da0]
push 0x48
mov dword [ebp - 0x74], eax
pop esi
je 0x1003e2bc
test byte [0x101505fc], 1
je 0x1003e2bf
mov dword [ebp - 0x74], esi
test byte [ebp - 0x74], 1
je 0x1003e2e4
cmp byte [0x1015cb48], bl
je 0x1003e2e4
push 0x10155a28
push 0x1015cb48
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003e2e4
mov dword [ebp - 0x74], esi
cmp dword [0x1015668c], 0x64
jne 0x1003e310
push dword [ebp + 0x2dac]
push dword [ebp + 0x2da8]
push dword [ebp + 0x2da4]
push dword [ebp - 0x74]
push str.SendInfoDisplay:_d:_d:_d:_d
push ebx
call fcn.100412e2
add esp, 0x18
push edi
mov esi, 0x1ff
push esi
lea eax, [ebp + 0x2595]
push ebx
push eax
mov byte [ebp + 0x2594], bl
call fcn.10045030
push esi
lea eax, [ebp + 0x2795]
push ebx
push eax
mov byte [ebp + 0x2794], bl
call fcn.10045030
push 0xdff
lea eax, [ebp + 0x995]
push ebx
push eax
mov byte [ebp + 0x994], bl
call fcn.10045030
mov edi, 0x9ff
push edi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.10045030
push edi
lea eax, [ebp + 0x1b95]
push ebx
push eax
mov byte [ebp + 0x1b94], bl
call fcn.10045030
mov eax, dword [0x102b5a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x2594]
push str.SoftWareTrojanCut_td_DDXP
push eax
mov edi, edx
add edi, 0x64
inc dword [0x102b5a40]
mov dword [ebp - 0x78], edi
call fcn.10045378
add esp, 0x44
push edi
lea eax, [ebp + 0x2794]
push 0x10061188
push eax
call fcn.10045378
push esi
lea eax, [ebp + 0x2b95]
push ebx
push eax
mov byte [ebp + 0x2b94], bl
call fcn.10045030
lea eax, [ebp - 0x80]
push eax
call fcn.100457db
lea eax, [ebp - 0x80]
push eax
call fcn.100457b4
add esp, 0x20
cmp eax, ebx
je 0x1003e41a
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x2b94]
push 0x200
push eax
call fcn.10046465
add esp, 0x10
jmp 0x1003e42d
or esi, 0xffffffff
cmp esi, 0xffffffff
jne 0x1003e29e
xor eax, eax
jmp 0x1003e78e
lea eax, [ebp + 0x2b94]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
test byte [0x10078cc8], 2
je 0x1003e545
lea eax, [ebp - 0x6c]
push 0xa00
push eax
call fcn.100338b5
push esi
lea eax, [ebp + 0x2995]
push ebx
push eax
mov byte [ebp + 0x2994], bl
call fcn.10045030
mov esi, dword [ebp - 0x70]
lea eax, [ebp + 0x2994]
push eax
add esi, 0x78c
push esi
call fcn.10040e29
add esp, 0x1c
cmp byte [0x102b5630], bl
je 0x1003e490
mov eax, 0x102b5630
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003e486
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.rundll32.exe
push esi
call edi
test eax, eax
jne 0x1003e4e7
push str.dllhost.exe
push esi
call edi
test eax, eax
jne 0x1003e4e7
push str.svchost.exe
push esi
call edi
test eax, eax
jne 0x1003e4e7
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2994]
push eax
push esi
call fcn.1000770a
pop ecx
push eax
push esi
lea eax, [ebp + 0x1b94]
push str._s__d__s__s
push eax
call fcn.10045378
add esp, 0x18
jmp 0x1003e584
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp + 0x1794]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x1003e4f3
lea eax, [ebp + 0x1794]
push 0x20
push eax
call fcn.10044f10
pop ecx
pop ecx
cmp eax, ebx
jne 0x1003e519
lea eax, [ebp + 0x1794]
jmp 0x1003e51a
inc eax
lea ecx, [ebp - 0x6c]
push ecx
push eax
lea eax, [ebp + 0x2994]
push eax
push esi
call fcn.1000770a
pop ecx
push eax
push esi
lea eax, [ebp + 0x1b94]
push str._s__d__s__s_0___s
push eax
call fcn.10045378
add esp, 0x1c
jmp 0x1003e584
cmp byte [0x102b5630], bl
je 0x1003e567
mov edx, dword [ebp - 0x70]
mov eax, 0x102b5630
add edx, 0x78c
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003e55d
mov eax, dword [ebp - 0x70]
add eax, 0x78c
push eax
lea eax, [ebp + 0x1b94]
push eax
call fcn.1000789a
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
pop ecx
pop ecx
push str._fdrv_
lea eax, [ebp + 0x1b94]
push eax
call edi
test eax, eax
jne 0x1003e70e
test byte [0x10151868], 1
mov eax, dword [ebp - 0x70]
lea ecx, [eax + 0x580]
je 0x1003e5f7
push 0x1014e918
push dword [eax + 0x780]
add eax, 0x380
push ecx
push eax
lea eax, [ebp + 0x1b94]
push eax
lea eax, [ebp + 0x2b94]
push eax
push dword [ebp + 0x2dac]
lea eax, [ebp + 0x994]
push dword [ebp + 0x2da8]
push dword [ebp + 0x2da4]
push dword [ebp - 0x74]
push str._d_d_d_d_s_s_s_s_d_s
push eax
call fcn.10045378
add esp, 0x30
jmp 0x1003e63b
push dword [eax + 0x780]
add eax, 0x380
push ecx
push eax
lea eax, [ebp + 0x1b94]
push eax
lea eax, [ebp + 0x2b94]
push eax
push dword [ebp + 0x2dac]
lea eax, [ebp + 0x994]
push dword [ebp + 0x2da8]
push dword [ebp + 0x2da4]
push dword [ebp - 0x74]
push str._d_d_d_d_s_s_s_s_d
push eax
call fcn.10045378
add esp, 0x2c
lea eax, [ebp + 0x994]
push eax
lea eax, [ebp + 0x2794]
push eax
lea eax, [ebp + 0x2594]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.100422d1
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.10041a19
add esp, 0x10
cmp dword [0x1015668c], 0x64
jne 0x1003e68e
push str.SendInfoDisplay_1
push ebx
call fcn.100412e2
pop ecx
pop ecx
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, 0x100610e0
push edi
push ebx
call esi
mov dword [ebp - 0x70], eax
cmp eax, ebx
jne 0x1003e6ce
push edi
push ebx
call esi
mov dword [ebp - 0x70], eax
cmp eax, ebx
jne 0x1003e6ce
push ebx
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.WS2_32.dll_bind
call fcn.10040ccf
add esp, 0x10
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x1003e6ee
test byte [ebp - 0x74], 1
push ebx
push dword [ebp - 0x78]
push 0xd60
push dword [ebp - 0x70]
je 0x1003e6e8
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1003e6ee
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x1015668c], 0x64
jne 0x1003e708
push dword [ebp - 0x70]
push str.SendInfoDisplay_2__d
push ebx
call fcn.100412e2
add esp, 0xc
test byte [ebp - 0x74], 0x40
je 0x1003e712
xor eax, eax
jmp 0x1003e78d
cmp dword [0x10157884], 1
jne 0x1003e78a
test byte [ebp - 0x74], 8
je 0x1003e78a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1015668c], 0x64
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jne 0x1003e749
call esi
push eax
push str.ExitProcess___d_
push ebx
call fcn.100412e2
add esp, 0xc
cmp dword [0x102b5a3c], 5
jne 0x1003e765
cmp dword [0x10078cd8], 0x501
jl 0x1003e765
call fcn.100164af
jmp 0x1003e78a
test byte [0x102d3d98], 2
je 0x1003e776
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call esi
push eax
call dword [0x1018797c]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp + 0x2d94]
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x2d98
leave
ret 0x10