Function at 0x474fc0
Capabilities:
Create thread
Delete registry key
Delete registry value
Encode data using base64
Get session user name
Inspect section memory permissions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4ee346
mov eax, dword fs:[0]
push eax
mov eax, 0xa2e8
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0xa2e4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0xa2fc]
mov dword fs:[0], eax
mov ebp, ecx
xor edi, edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x28], edi
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0xa304], edi
push str.LoadConfigParam
push 8
call fcn.0043d500
mov eax, dword [0x103ad10]
push 1
push 0x1038b00
push 0xa1
push str.backupagent
push 4
push eax
call fcn.004de800
add esp, 0x20
mov dword [0x1038d1c], eax
cmp eax, edi
jne 0x475066
mov dword [0x1038d1c], str.backupagent
mov dword [0x1038b00], 0xa1
mov ecx, dword [0x103ad10]
push 2
push 0x1038b04
push 0x9d
push str.facebookupdate.exe
push 5
push ecx
call fcn.004de800
add esp, 0x18
mov dword [0x1038d20], eax
cmp eax, edi
jne 0x4750a5
mov dword [0x1038d20], str.facebookupdate.exe
mov dword [0x1038b04], 0x9d
push 0x16b00
lea eax, [ebp + 0x7f10]
push edi
push eax
mov dword [esp + 0x38], eax
call sub.MSVCR90.dll_memset
push edi
push str.tc_OnlyIconUI
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push edi
push str.tc_Care
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1039f58], eax
call fcn.00491d40
mov dword [0x1039f54], eax
shr eax, 0x14
push edi
and eax, 0xf
push str.tc_Log
lea edx, [eax + eax*4]
add edx, edx
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1039f50], edx
call fcn.00491d40
mov ecx, dword [0x1038af8]
push ecx
push eax
push str.g_bLog_0x_x_g_bLog_cmdline_0x_x_
push 8
mov dword [0x103a97c], eax
call fcn.0043d500
mov eax, dword [0x1038af8]
add esp, 0x4c
cmp eax, edi
je 0x47513f
mov dword [0x103a97c], eax
push 3
push str.tc_TCD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push 3
mov dword [ebp + 0x81fc], eax
push str.tc_POPUP_DELAY_TIME
mov dword [0x53ed90], 3
mov edx, dword [ebp + 0x81fc]
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8200], edx
call fcn.00491d40
add esp, 0x20
mov dword [ebp + 0x8290], eax
cmp dword [0x1038af8], edi
jne 0x4751a3
mov eax, dword [0x103a97c]
mov dword [ebp + 0x828c], eax
push 1
push str.tc_CUT_POPUP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push edi
push str.tc_Cut_List
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x819c], eax
call fcn.00491d40
push edi
push str.tc_COMMIT_POPUP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8294], eax
call fcn.00491d40
push edi
push str.tc_COMMIT_LIST
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81a0], eax
call fcn.00491d40
add esp, 0x40
push edi
push str.tc_COMMIT_LOG_SAVEFILE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81a4], eax
call fcn.00491d40
push edi
push str.tc_DDOS_AP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81a8], eax
mov dword [ebp + 0x81ac], 1
call fcn.00491d40
push 1
push str.tc_StealthPatch
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81b0], eax
call fcn.00491d40
push edi
push str.tc_Sierra
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81b4], eax
call fcn.00491d40
add esp, 0x40
mov dword [ebp + 0x82c0], eax
test al, 0x40
je 0x47536a
cmp byte [0x103a972], 0
je 0x4752e9
call fcn.00468860
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.administrators
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa30c], 1
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x103ad10
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa310], 2
mov byte [esp + 0xa310], 0
call fcn.00468620
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
call fcn.00465390
mov byte [esp + 0xa308], 3
push edi
push str.tc_UNINSTALL_PASSWORD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
add esp, 0x14
push str._tc_un.exe
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_945]
mov edx, dword [esp + 0x2c]
push edi
push edi
push 0x5138dc
push edx
push str.open
push edi
call fcn.00464ac0
add esp, 0x18
mov byte [esp + 0xa304], 0
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0xa304], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov al, 1
jmp 0x47b084
mov eax, dword [0x1043108]
shr eax, 4
not eax
and eax, 1
push edi
push eax
call fcn.0046efe0
push edi
push str.tc_UNINSTALL_PASSWORD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push edi
push str.tc_Finish_PASSWORD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81c4], eax
call fcn.00491d40
push 1
push str.tc_Cut_USB
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x1e9d8], eax
call fcn.00491d40
push edi
push str.tc_EdrL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8298], eax
call fcn.00491d40
add esp, 0x48
push edi
push str.tc_SPROCESS_EXP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x829c], eax
call fcn.00491d40
push edi
push str.tc_SFILE_EXP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81c8], eax
call fcn.00491d40
push edi
push str.tc_PROCESS_EXP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81cc], eax
call fcn.00491d40
push edi
push str.tc_FILE_EXP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81d0], eax
call fcn.00491d40
add esp, 0x40
push 6
push str.tc_TIME_AP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81d4], eax
call fcn.00491d40
push edi
push str.tc_FTP_Folder
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81f4], eax
call fcn.00491d40
push edi
push str.tc_BPRIVATEEYE_FOLDER
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81ec], eax
call fcn.00491d40
push edi
push str.tc_PERFORMANCE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81dc], eax
call fcn.00491d40
add esp, 0x40
mov ecx, eax
mov dword [ebp + 0x82c8], eax
shr eax, 8
and ecx, 0xff
and eax, 0xffff
mov dword [ebp + 0x82cc], ecx
mov dword [ebp + 0x82d0], eax
cmp ecx, edi
jne 0x4754f9
mov dword [0x53e8bc], 0x36ee80
jmp 0x475505
imul ecx, ecx, 0x36ee80
mov dword [0x53e8bc], ecx
push edi
push str.tc_PCTIME
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
add esp, 0x10
mov dword [ebp + 0x8284], eax
mov dword [0x742de0], eax
mov byte [0x1038f41], 0
test al, 0x40
je 0x475546
test al, al
jns 0x47553c
shr eax, 0x12
jmp 0x47553f
shr eax, 0x1a
and al, 1
mov byte [0x1038f41], al
test dword [ebp + 0x8284], 0x40000000
je 0x475598
push edi
push str.tc_MENU_EXP_Time
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
push edi
push str.tc_MENU_EXP_ID
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
push 0x5116d8
push str.tc_MENU_EXP_EXE
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x30
push 2
push 1
push 1
push 1
call fcn.0044e020
push edi
push str.tc_PE_IE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x53ed88], eax
call fcn.00491d40
push edi
push str.tc_ADD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81d8], eax
call fcn.00491d40
push edi
push str.tc_DELBHO
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x82c4], eax
call fcn.00491d40
add esp, 0x40
push edi
push str.tc_DELTOOLBAR
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
mov dword [ebp + 0x81f0], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1038f34], eax
call fcn.00491d40
push edi
push str.tc_NOINTERNET
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
mov dword [ebp + 0x82bc], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1038f48], eax
call fcn.00491d40
push 2
push str.tc_STEALTH
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x82a0], eax
call fcn.00491d40
add esp, 0x30
mov dword [ebp + 0x8288], eax
mov dword [0x103a364], eax
test eax, 0xff000000
je 0x475671
and eax, 0xfffffff8
mov dword [0x103a364], eax
push edi
push str.tc_CARE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
add esp, 0x10
mov dword [ebp + 0x82a4], eax
test eax, 0x10000000
je 0x47569a
push 1
jmp 0x47569b
push edi
push str.tc_demo
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x10
push edi
push str.tc_ALLNOCUT
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push edi
push str.tc_UNUSETYPE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
mov dword [ebp + 0x8204], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1038d2c], eax
call fcn.00491d40
push edi
push str.tc_ReadOnlyTYPE
mov dword [ebp + 0x82ac], eax
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1038d24], eax
mov dword [0x1038d18], edi
call fcn.00491d40
push 1
push str.tc_DDOS_POPUP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
mov dword [ebp + 0x82a8], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1038f30], eax
call fcn.00491d40
add esp, 0x40
push 1
push str.tc_DDOS_LIST
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81b8], eax
call fcn.00491d40
push 1
push str.tc_DDOS_LOG_SAVEFILE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81bc], eax
call fcn.00491d40
push 2
push str.tc_DDOS_KILL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81c0], eax
call fcn.00491d40
push edi
push str.tc_W_L
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81f8], eax
call fcn.00491d40
add esp, 0x40
push 0x4000
push str.tc_WTYPE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8228], eax
call fcn.00491d40
push 0x111111
push str.tc_Engine
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
mov dword [ebp + 0x82b0], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1038d14], eax
call fcn.00491d40
push edi
push str.tc_Option1
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x82b8], eax
call fcn.00491d40
mov dword [ebp + 0x8268], eax
add esp, 0x30
mov dword [0x1038f38], eax
mov dword [0x10d9864], edi
push 0x5116d8
mov ecx, 0x103ad80
mov dword [0x10da068], edi
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [0x1038f38]
test eax, 0x800
je 0x475880
mov dl, byte [0x10430dc]
mov ecx, eax
and ecx, 0x1000
mov esi, 0xa
je 0x475857
test dl, dl
jns 0x475862
mov esi, 0x32
jmp 0x47586b
test dl, dl
jns 0x475862
mov esi, 0x1e
jmp 0x47586b
cmp ecx, edi
je 0x47586b
mov esi, 0x14
test eax, 0x10000
je 0x47587a
mov dword [0x10d9864], esi
jmp 0x475880
mov dword [0x10da068], esi
lea ecx, [esp + 0x78]
push ecx
call fcn.00465390
add esp, 4
mov byte [esp + 0xa304], 4
push str.TC_Bk
lea ecx, [esp + 0x7c]
call dword [sym.imp.mfc90.dll_Ordinal_945]
push ecx
lea edx, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 5
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 4
call fcn.004a6a60
add esp, 8
mov byte [esp + 0xa304], 6
push eax
mov ecx, 0x103ad80
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 4
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test dword [ebp + 0x8268], 0x20000000
je 0x475913
mov byte [0x10388b2], 1
mov byte [ebp + 0x2b4], 1
mov eax, dword [ebp + 0x8268]
test eax, 0x60000000
jne 0x475938
push edi
push str.tc_PER
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x10
push edi
push str.tc_flt_set
push str.SOFTWARETrueCutTC_FLT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push 0x64
lea esi, [ebp + 0x1518a]
push esi
push str.tc_flt_search
push str.SOFTWARETrueCutTC_FLT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x826c], eax
call fcn.00491b30
add esp, 0x24
cmp eax, 0xffffffff
jne 0x47597b
mov byte [esi], 0
push 0x190
push str.tc_DDX_H_Q
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push 0x28
push str.tc_DDX_H_S
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8208], eax
call fcn.00491d40
push 0x190
push str.tc_DDX_H_G
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x820c], eax
call fcn.00491d40
push 0x190
push str.tc_DDX_T_C
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8210], eax
call fcn.00491d40
add esp, 0x40
push 0x28
push str.tc_DDX_T_S
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8214], eax
call fcn.00491d40
push 0x190
push str.tc_DDX_U
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8218], eax
call fcn.00491d40
push 0x14
push str.tc_DDX_I
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x821c], eax
call fcn.00491d40
push 0x3c
push str.tc_DDX_S
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8220], eax
call fcn.00491d40
add esp, 0x40
cmp byte [ebp + 0x2b4], 0
mov dword [ebp + 0x8224], eax
mov ebx, 9
je 0x475b51
mov eax, dword [0x1038f38]
mov ecx, eax
and ecx, 0x60000000
cmp ecx, 0x60000000
jne 0x475af9
and eax, 0xffffbfff
or eax, 0x400000
push eax
push str.tc_Option1
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x571ae8], ebx
mov byte [0x571aec], 1
mov dword [0x53e3dc], 0xa
mov dword [0x1038f38], eax
mov dword [0x10430b0], eax
call fcn.00491ff0
push 0x104fa76
push str.tc_BackUpFolder
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [0x104fa76], 0
call fcn.00491e90
add esp, 0x20
jmp 0x475b51
push edi
push str.tc_EachNoCut_Per
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push edi
push str.tc_SendLog2Manager
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x571ae8], eax
call fcn.00491d40
push 0xa
push str.tc_BackUpRoom
test eax, eax
setne dl
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [0x571aec], dl
call fcn.00491d40
add esp, 0x30
mov dword [0x53e3dc], eax
push 0x9fff
lea eax, [esp + 0x2fd]
push edi
push eax
mov byte [esp + 0x304], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
test dword [ebp + 0x82c0], 0x10000000
jne 0x475b88
test byte [0x1038f38], 0x20
je 0x475c2c
push 0xa000
lea ecx, [esp + 0x2fc]
push ecx
push str.tc_DiskID
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x475bb9
mov byte [esp + 0x2f8], 0
lea edx, [esp + 0x24]
push edx
call fcn.00471ee0
mov byte [esp + 0xa308], 7
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x2fc]
push eax
push ecx
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 0xc
test eax, eax
je 0x475c1a
push 0x5116d8
push str.TC_MACFIX_NEW
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esp + 0x34]
push edx
push str.tc_DiskID
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x20
mov byte [esp + 0xa304], 4
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0xa000
lea eax, [esp + 0x2fc]
push eax
push str.tC_Sweep
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x475c5d
mov byte [esp + 0x2f8], 0
lea ecx, [esp + 0x2f8]
push ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 8
mov eax, dword [esp + 0x14]
mov edx, ebp
mov esi, 0x10
mov dword [ebp + 0x822c], 1
or dword [0x103a360], esi
sub edx, eax
add edx, 0x90d8
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x475ca0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], bl
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0xa
push edi
push str.juneblue
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_2481]
test eax, eax
jl 0x475d00
mov dword [ebp + 0x822c], edi
or dword [0x103a360], esi
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dl, byte [0x10430b0]
and dl, 0x80
movzx eax, dl
neg eax
sbb eax, eax
and eax, 0x4b0
add eax, 0x12c
mov esi, bind
mov dword [0x53efa8], eax
test dword [0x1039f54], esi
je 0x475d83
cmp dword [ebp + 0x822c], edi
je 0x475d83
push 0x53ea40
call fcn.00466a10
add esp, 4
cmp eax, dword [0x53efa8]
jb 0x475d7b
mov ecx, dword [0x53ea40]
push ecx
push str.tc_AutoEngine
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x10
jmp 0x475d8f
mov dword [ebp + 0x822c], edi
jmp 0x475d8f
mov edx, dword [ebp + 0x82b8]
mov dword [0x53ea40], edx
push 0xa000
lea eax, [esp + 0x2fc]
push eax
push str.tc_USBExpList
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x475dc0
mov byte [esp + 0x2f8], 0
lea ecx, [esp + 0x2f8]
push ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
cmp eax, edi
je 0x475e5a
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0xb
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0xc
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x475e5a
cmp ecx, 0x1000
jae 0x475e5a
mov edx, ebp
sub edx, eax
add edx, 0x152b6
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x475e50
mov ebx, dword [sym.imp.MSVCR90.dll_sprintf]
test dword [0x1038d14], esi
jne 0x4760db
test dword [0x10430dc], 0x1000000
je 0x4760db
push 0xa000
lea eax, [esp + 0x2fc]
push eax
push str.tc_Dec
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x475eaf
mov byte [esp + 0x2f8], 0
jmp 0x475f1f
cmp byte [esp + 0x2f8], 0
je 0x475f1f
lea ecx, [esp + 0x2f8]
push ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0xd
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0xe
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor eax, eax
push 0x50bd94
mov dword [0x101ebdc], eax
mov dword [0x101ebe0], eax
mov dword [0x101ebe4], eax
mov dword [0x101ebe8], eax
mov dword [0x101ebec], eax
call fcn.004670f0
add esp, 4
cmp eax, 1
jle 0x475f84
cmp byte [esp + 0x2f8], 0
je 0x4760b5
mov ecx, dword [esp + 0x18]
push ecx
push str.:_s.doc
push 0x1038608
call ebx
mov edx, dword [esp + 0x24]
push edx
push str.:_s.jpg
push 0x103861c
call ebx
add esp, 0x18
jmp 0x4760b5
cmp byte [esp + 0x2f8], 0
je 0x475fa2
mov eax, dword [esp + 0x18]
push eax
push str.:_s
push 0x101ebdc
call ebx
add esp, 0xc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
push esi
call dword [sym.imp.MSVCR90.dll_srand]
mov esi, dword [sym.imp.MSVCR90.dll_rand]
add esp, 4
call esi
mov ecx, 0x61
lea edx, [esp + 0x30]
mov word [esp + 0x30], cx
push edx
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 0xf
mov edi, 7
lea ebx, [ebx]
call esi
cdq
mov ecx, 0x24
idiv ecx
cmp edx, 0xa
jge 0x476004
add dl, 0x30
jmp 0x476007
add dl, 0x57
mov byte [esp + 0x30], dl
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_945]
sub edi, 1
jne 0x475ff0
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x10
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0xa30c], 0xf
call fcn.0048ecd0
mov byte [esp + 0xa30c], 0x11
mov edx, dword [esp + 0x28]
push edx
push str.tc_Dec
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov eax, dword [esp + 0x3c]
push eax
push str.:_s.doc
push 0x1038608
call ebx
mov ecx, dword [esp + 0x48]
push ecx
push str.:_s.jpg
push 0x103861c
call ebx
add esp, 0x30
mov byte [esp + 0xa304], 0xf
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp dword [0x103a97c], edi
je 0x4760db
push 0x101ebdc
push 0x103861c
push 0x1038608
push str.g_tc_DecoyDocx__s_g_tc_DecoyJpg__s_g_tc_DecoyDocx_old__s_
push 8
call fcn.0043d500
add esp, 0x14
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ExceptDeviceContext
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47610c
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
cmp eax, edi
je 0x476236
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x12
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x13
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x4761aa
cmp ecx, 0x200
jae 0x4761aa
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x14dfa]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4761a0
lea edx, [ebp + 0x14dfa]
push edx
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 0x14
push 0x5028fc
lea eax, [esp + 0x24]
push 0x103ae24
push eax
call fcn.00492540
add esp, 0xc
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp dword [0x103a97c], 0x94
jne 0x476236
mov eax, dword [0x103ae2c]
xor esi, esi
cmp eax, edi
jle 0x476236
cmp esi, edi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov ecx, dword [0x103ae28]
mov edx, dword [ecx + esi*4]
push edx
push str.g_tc_ExceptDeviceContext__s_
push 8
call fcn.0043d500
mov eax, dword [0x103ae2c]
inc esi
add esp, 0xc
cmp esi, eax
jl 0x476203
push edi
push str.tc_DetectType
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push 3
push str.tc_LogDelMonth
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x82b4], eax
call fcn.00491d40
add esp, 0x20
cmp byte [ebp + 0x2b4], 0
mov dword [ebp + 0x8230], eax
je 0x47628d
test dword [0x1038f38], 0x20000000
je 0x47628d
mov dword [ebp + 0x8234], edi
jmp 0x4762ac
push 1
push str.tc_LogDelSent
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
add esp, 0x10
mov dword [ebp + 0x8234], eax
push edi
push str.tc_SW_SF
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push 0x64
push str.tc_MaxLogSize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8280], eax
call fcn.00491d40
add esp, 0x20
cmp eax, 0x64
mov dword [ebp + 0x8238], eax
jge 0x4762f0
mov eax, 0x64
shl eax, 0xa
test dword [0x10430b0], 0x800
mov dword [0x53ed94], eax
je 0x47630e
lea eax, [eax + eax*4]
add eax, eax
mov dword [0x53ed94], eax
push edi
push str.tc_Speed
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
mov dword [ebp + 0x823c], eax
mov ecx, eax
and ecx, 0x101000
mov dword [0x1038f3c], ecx
mov dword [0x1038f44], eax
mov edx, eax
shr edx, 0x11
mov ecx, eax
and dl, 1
shr eax, 0x12
mov byte [0x10388b3], dl
and ecx, 0x21e000
and al, 1
mov dword [0x53ed8c], ecx
mov byte [0x1038f40], al
mov edx, dword [ebp + 0x823c]
push 0x200
shr edx, 9
and dl, 1
push edi
push 0x101e9d8
mov byte [ebp + 0xad], dl
mov dword [esp + 0xac], 0x200
call sub.MSVCR90.dll_memset
add esp, 0x1c
lea eax, [esp + 0x90]
push eax
push 0x101e9d8
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp byte [0x103aef5], 0
je 0x4763be
push 0x101e9d8
mov ecx, 0x1070800
call dword [sym.imp.mfc90.dll_Ordinal_820]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00466dc0
add esp, 8
mov byte [esp + 0xa304], 0x15
push eax
mov ecx, 0x103acc0
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp byte [ebp + 0x2b4], 0
jne 0x476479
mov edx, dword [0x103acc0]
push edx
push 0x101e9d8
push str.Login_ID__s__ProcessOwner__s_
push 8
call fcn.0043d500
add esp, 0x10
push 3
lea eax, [esp + 0x100]
push 0x101e9d8
lea ecx, [esp + 0x100]
mov dword [esp + 0x100], eax
call fcn.0041cfe0
mov byte [esp + 0xa304], 0x16
mov ecx, dword [esp + 0xf8]
push ecx
call fcn.00467000
add esp, 4
mov byte [esp + 0xa304], 8
mov eax, dword [esp + 0xf8]
lea edx, [esp + 0xfc]
cmp eax, edx
je 0x476479
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
cmp byte [0x103aef5], 0
jne 0x476492
test dword [ebp + 0x823c], 0x400
je 0x476526
push str.system
push 0x101e9d8
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
je 0x4764c7
push 0x101e9d8
push str.TC_UID
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
jmp 0x476512
push 0x200
lea eax, [esp + 0xfc]
push eax
push str.TC_UID
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4764f8
mov byte [esp + 0xf8], 0
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0xf8]
mov byte [eax + 0x101e9d8], cl
inc eax
test cl, cl
jne 0x476500
push 0x101e9d8
push str.TC_UID_:__s
push 8
call fcn.0043d500
add esp, 0xc
push edi
call fcn.00472e70
push edi
push str.tc_WaterMark
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push edi
push str.tc_WM_Height
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8244], eax
call fcn.00491d40
push edi
push str.tc_WM_Blend
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8248], eax
call fcn.00491d40
push edi
push str.tc_WM_S_FontSize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x824c], eax
call fcn.00491d40
add esp, 0x44
push edi
push str.tc_WM_S_FontWeight
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8250], eax
call fcn.00491d40
push edi
push str.tc_WM_S_FontColor
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8258], eax
call fcn.00491d40
push 0xa000
lea ecx, [esp + 0x31c]
push ecx
push str.tc_WM_S_FontName
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8254], eax
call fcn.00491b30
add esp, 0x34
cmp eax, 0xffffffff
jne 0x476602
mov byte [esp + 0x2f8], 0
lea edx, [esp + 0x2f8]
push edx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x47663a
cmp ecx, 0x64
jae 0x47663a
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1090a]
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476630
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_WM_S_String
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47666b
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x4766a1
cmp ecx, 0x64
jae 0x4766a1
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1096e]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476697
push 0xffffffffffffffff
push edi
mov ecx, 0x729b90
call sub.mfc90.dll_Ordinal_6494
push 0xffffffffffffffff
push edi
mov ecx, 0x729bb8
call sub.mfc90.dll_Ordinal_6494
push 0xffffffffffffffff
push edi
mov ecx, 0x103addc
call sub.mfc90.dll_Ordinal_6494
push 0xffffffffffffffff
push edi
mov ecx, 0x103ae04
call sub.mfc90.dll_Ordinal_6494
push 0xffffffffffffffff
push edi
mov ecx, 0x103ad84
call sub.mfc90.dll_Ordinal_6494
push 0xffffffffffffffff
push edi
mov ecx, 0x103ace0
call sub.mfc90.dll_Ordinal_6494
push 0x5116d8
mov ecx, 0x10dd334
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
mov ecx, 0x10dd260
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
mov ecx, 0x10dd25c
call dword [sym.imp.mfc90.dll_Ordinal_820]
push edi
push str.tc_DLL_Exp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push edi
push str.tc_SvrAgent
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x81e0], eax
call fcn.00491d40
push 0xa000
lea edx, [esp + 0x31c]
push edx
push str.tc_UserExpTitle
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x82d4], eax
call fcn.00491b30
add esp, 0x34
cmp eax, 0xffffffff
jne 0x476786
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x4767bc
cmp ecx, 0x64
jae 0x4767bc
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1b51a]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4767b2
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_FileExtExp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4767ed
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x17
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x18
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x47687a
cmp ecx, 0x200
jae 0x47687a
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1b57e]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476870
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_FileExtCut
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4768ab
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x19
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x1a
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x47693a
cmp ecx, 0x200
jae 0x47693a
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1b77e]
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476930
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_EDRLTraceExt
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47696b
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x1b
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x1c
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x4769fa
cmp ecx, 0x200
jae 0x4769fa
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1b97e]
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4769f0
push edi
push str.tc_DefenderScanDay
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push edi
push str.tc_DefenderScanTime
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8270], eax
call fcn.00491d40
push 0xa000
lea edx, [esp + 0x31c]
push edx
push str.tc_DefenderFolderExp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8274], eax
call fcn.00491b30
add esp, 0x34
cmp eax, 0xffffffff
jne 0x476a61
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x1d
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x1e
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x476aee
cmp ecx, 0x1400
jae 0x476aee
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1bdd6]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476ae4
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_DefenderExtExp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x476b1f
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x1f
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x20
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x476bac
cmp ecx, 0x200
jae 0x476bac
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1d1d6]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x476ba2
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_DefenderProcessExp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x476bdd
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x21
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x22
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x476c6a
cmp ecx, 0x1400
jae 0x476c6a
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1d3d6]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x476c60
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_SvrAgentScanTime
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x476c9b
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x476cd1
cmp ecx, 0x32
jae 0x476cd1
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0xf8d8]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476cc7
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_SvrAgentDetectFolder
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x476d02
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
cmp eax, edi
je 0x476e22
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x23
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x24
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x476daa
cmp ecx, 0x200
jae 0x476daa
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0xf6d8]
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476da0
push 0xffffffffffffffff
push edi
mov ecx, 0x103ad68
call sub.mfc90.dll_Ordinal_6494
lea ecx, [esp + 0x7c]
call sub.mfc90.dll_Ordinal_580
mov byte [esp + 0xa304], 0x25
push 0x5028f0
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00492540
mov eax, dword [esp + 0x90]
add esp, 0xc
cmp eax, 1
jl 0x476e11
cmp eax, edi
jg 0x476df7
call sub.mfc90.dll_Ordinal_1252
mov ecx, dword [esp + 0x80]
push 0x5028fc
push 0x103ad68
push ecx
call fcn.00492540
add esp, 0xc
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x7c]
call sub.mfc90.dll_Ordinal_781
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ExceptDLLs
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x476e53
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], edi
je 0x476eea
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x26
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x27
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x476eea
cmp ecx, 0x1000
jae 0x476eea
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0xe6d8]
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476ee0
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ForceCom
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x476f1b
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], edi
je 0x476fb1
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x28
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x29
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x476fb1
cmp ecx, 0x1000
jae 0x476fb1
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0xf90a]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x476fa7
cmp byte [0x103b0fc], 0
mov eax, str.tc_ExceptProcessEnable
jne 0x476fc4
mov eax, str.tc_ExceptProcess
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push eax
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x476ff1
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
cmp eax, edi
je 0x47773f
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x2a
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x2b
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
cmp ecx, edi
jle 0x47773f
cmp ecx, 0x5000
jae 0x47773f
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x96d8]
jmp 0x477090
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x477090
push 0x5028f0
lea edx, [esp + 0x1c]
push 0x103ace0
push edx
call fcn.00492540
mov eax, dword [0x103ace8]
add esp, 0xc
cmp byte [0x103b0fc], 0
je 0x477150
cmp eax, 1
jl 0x4770ee
cmp eax, edi
jg 0x4770d1
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [0x103ace4]
push 0x5028f8
push 0x103addc
push eax
call fcn.00492540
mov eax, dword [0x103ace8]
add esp, 0xc
cmp eax, 2
jl 0x47711d
cmp eax, 1
jg 0x4770fd
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [0x103ace4]
push 0x5028f8
add eax, 4
push 0x103ad84
push eax
call fcn.00492540
mov eax, dword [0x103ace8]
add esp, 0xc
cmp eax, 3
jl 0x47724f
cmp eax, 2
jg 0x477130
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [0x103ace4]
push 0x5028f8
add eax, 8
push 0x103ae04
push eax
call fcn.00492540
add esp, 0xc
jmp 0x47724a
cmp eax, 1
jl 0x47717c
cmp eax, edi
jg 0x47715e
call sub.mfc90.dll_Ordinal_1252
mov ecx, dword [0x103ace4]
push 0x5028fc
push 0x103addc
push ecx
call fcn.00492540
mov eax, dword [0x103ace8]
add esp, 0xc
cmp eax, 2
jl 0x4771ab
cmp eax, 1
jg 0x47718b
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [0x103ace4]
push 0x5028fc
add eax, 4
push 0x103ad84
push eax
call fcn.00492540
mov eax, dword [0x103ace8]
add esp, 0xc
cmp eax, 3
jl 0x4771da
cmp eax, 2
jg 0x4771ba
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [0x103ace4]
push 0x5028fc
add eax, 8
push 0x103ae04
push eax
call fcn.00492540
mov eax, dword [0x103ace8]
add esp, 0xc
cmp eax, 1
jl 0x4771ff
cmp eax, edi
jg 0x4771e8
call sub.mfc90.dll_Ordinal_1252
mov edx, dword [0x103ace4]
push edx
mov ecx, 0x10dd334
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov eax, dword [0x103ace8]
cmp eax, 2
jl 0x477227
cmp eax, 1
jg 0x47720e
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [0x103ace4]
add eax, 4
push eax
mov ecx, 0x10dd260
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov eax, dword [0x103ace8]
cmp eax, 3
jl 0x47724f
cmp eax, 2
jg 0x477236
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [0x103ace4]
add eax, 8
push eax
mov ecx, 0x10dd25c
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov eax, dword [0x103ace8]
xor bl, bl
cmp dword [0x103ad8c], edi
je 0x47796a
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [0x103a97c], edi
je 0x4772c8
push 0xffffffffffffffff
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x3c]
call fcn.0044a210
push edi
push edi
push 0xc
push edi
lea ecx, [esp + 0x7c]
call fcn.0042a1f0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add dword [esp + 0x34], ecx
lea ecx, [esp + 0x34]
adc dword [esp + 0x38], eax
call fcn.00409350
push eax
lea ecx, [esp + 0x38]
call fcn.00409320
push eax
lea ecx, [esp + 0x3c]
call fcn.004092f0
push eax
push str._04d__02d__02d
lea edx, [esp + 0xa4]
push edx
jmp 0x4772e7
movzx eax, word [esp + 0x5e]
movzx ecx, word [esp + 0x5a]
movzx edx, word [esp + 0x58]
push eax
push ecx
push edx
push str._04d__02d__02d
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
mov ecx, dword [0x103ade4]
add esp, 0x14
xor edi, edi
test ecx, ecx
jle 0x47762e
lea esi, [edi + 8]
cmp edi, 0x400
jge 0x4775f3
test edi, edi
jl 0x476df2
cmp edi, dword [0x103ad8c]
jge 0x476df2
mov ecx, dword [0x103ad88]
mov edx, dword [ecx + edi*4]
cmp dword [edx - 0xc], 0
lea ecx, [ecx + edi*4]
jne 0x477464
cmp dword [0x103ae0c], edi
jle 0x47734b
mov eax, dword [0x103ae08]
lea eax, [eax + edi*4]
jmp 0x477367
push 0x5116d8
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 0x2c
or dword [esp + 0x28], 1
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0xa308], 0x2d
cmp edi, dword [0x103ade4]
jge 0x476df2
mov ecx, dword [0x103ade0]
push ecx
lea eax, [ecx + edi*4]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x2e
mov byte [esp + 0xa30c], 0x2c
call fcn.0044a7b0
add esp, 8
mov dword [esp + 0xa304], esi
test byte [esp + 0x28], 1
je 0x4773d8
and dword [esp + 0x28], 0xfffffffe
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp dword [0x103a97c], 0
je 0x4775e4
cmp dword [0x103ae0c], edi
jle 0x4773fa
push edi
mov ecx, 0x103ae04
call fcn.004094e0
jmp 0x477416
push 0x5116d8
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 0x2f
or dword [esp + 0x28], 2
cmp edi, dword [0x103ade4]
mov eax, dword [eax]
jge 0x476df2
mov edx, dword [0x103ade0]
push eax
mov eax, dword [edx + edi*4]
push eax
push edi
push str.g_EP_arData__d___s__folder__s_
push esi
call fcn.0043d500
add esp, 0x14
mov dword [esp + 0xa304], esi
test byte [esp + 0x28], 2
je 0x4775e4
and dword [esp + 0x28], 0xfffffffd
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x4775e4
push 0
push 0x502aa0
call dword [sym.imp.mfc90.dll_Ordinal_2481]
cmp eax, 0xffffffff
je 0x4775e4
cmp edi, dword [0x103ad8c]
jge 0x476df2
mov ecx, dword [0x103ad88]
mov ecx, dword [ecx + edi*4]
lea eax, [esp + 0x94]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4774b6
test dl, dl
je 0x4774b2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4774b6
add eax, 2
add ecx, 2
test dl, dl
jne 0x477496
xor eax, eax
jmp 0x4774bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jg 0x4775e2
cmp dword [0x103ae0c], edi
jle 0x4774d8
push edi
mov ecx, 0x103ae04
call fcn.004094e0
jmp 0x4774f4
push 0x5116d8
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 0x30
or dword [esp + 0x28], 4
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0xa308], 0x31
push edi
mov ecx, 0x103addc
call fcn.004094e0
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x32
mov byte [esp + 0xa30c], 0x30
call fcn.0044a7b0
add esp, 8
mov dword [esp + 0xa304], esi
mov ebx, dword [esp + 0x28]
test bl, 4
je 0x47755f
and ebx, 0xfffffffb
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], ebx
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp dword [0x103a97c], 0
je 0x4775e2
cmp dword [0x103ae0c], edi
jle 0x47757d
push edi
mov ecx, 0x103ae04
call fcn.004094e0
jmp 0x47759b
push 0x5116d8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 0x33
or ebx, 8
mov dword [esp + 0x28], ebx
mov esi, dword [eax]
push edi
mov ecx, 0x103addc
call fcn.004094e0
mov edx, dword [eax]
push esi
push edx
push edi
push str.g_EP_arData2__d___s__folder__s_
push 8
call fcn.0043d500
add esp, 0x14
mov dword [esp + 0xa304], 8
test bl, 8
je 0x4775dd
and ebx, 0xfffffff7
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], ebx
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov esi, 8
mov bl, 1
mov ecx, dword [0x103ade4]
inc edi
cmp edi, ecx
jl 0x477303
test bl, bl
je 0x47762e
cmp dword [0x103a998], 0
jne 0x47762e
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0x46fc50
push 0
push 0
mov dword [esp + 0x34], 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
mov ecx, dword [0x103ade4]
add esp, 0x18
mov dword [0x103a998], eax
mov eax, dword [0x103ace8]
cmp dword [0x103a97c], 0
je 0x47773f
xor esi, esi
test eax, eax
jle 0x47767f
test esi, esi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov eax, dword [0x103ace4]
mov ecx, dword [eax + esi*4]
push ecx
push esi
push str.g_EP_arDataAll___d___s_
push 8
call fcn.0043d500
mov eax, dword [0x103ace8]
inc esi
add esp, 0x10
cmp esi, eax
jl 0x477646
mov ecx, dword [0x103ade4]
xor esi, esi
test ecx, ecx
jle 0x4776ba
test esi, esi
jl 0x476df2
cmp esi, ecx
jge 0x476df2
mov edx, dword [0x103ade0]
mov eax, dword [edx + esi*4]
push eax
push esi
push str.g_EP_arData___d___s_
push 8
call fcn.0043d500
mov ecx, dword [0x103ade4]
inc esi
add esp, 0x10
cmp esi, ecx
jl 0x477685
mov eax, dword [0x103ae0c]
xor esi, esi
test eax, eax
jle 0x4776f9
test esi, esi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov ecx, dword [0x103ae08]
mov edx, dword [ecx + esi*4]
push edx
push esi
push str.g_EP_arDataFolder___d___s_
push 8
call fcn.0043d500
mov eax, dword [0x103ae0c]
inc esi
add esp, 0x10
cmp esi, eax
jl 0x4776c5
xor esi, esi
cmp dword [0x103ad8c], esi
jle 0x47773f
mov eax, dword [0x103ad8c]
test esi, esi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov eax, dword [0x103ad88]
mov ecx, dword [eax + esi*4]
push ecx
push esi
push str.g_EP_arDataIP___d___s_
push 8
call fcn.0043d500
mov eax, dword [0x103ad8c]
inc esi
add esp, 0x10
cmp esi, eax
jl 0x477708
mov ebp, dword [esp + 0x3c]
push 0xffffffffffffffff
lea ebx, [ebp + 0x3598c]
push 0
mov ecx, ebx
call sub.mfc90.dll_Ordinal_6494
push 0x5116d8
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
mov ecx, 0x103ac64
call dword [sym.imp.mfc90.dll_Ordinal_820]
call fcn.0046f800
mov edi, 0x73
cmp dword [0x103a97c], edi
jne 0x47779e
mov edx, dword [0x103ac64]
mov eax, dword [0x103add8]
push edx
push eax
push str.Get_tc_BlackList_from_BlackFile_:___s__s_
push 0
call fcn.0043d500
add esp, 0x10
push 0xa000
lea ecx, [esp + 0x2fc]
push ecx
push str.tc_BlackList
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4777cf
mov byte [esp + 0x2f8], 0
lea edx, [esp + 0x2f8]
push edx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x38
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0xa30c], 8
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x39
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov esi, dword [esp + 0x18]
mov eax, dword [esi - 0xc]
test eax, eax
jle 0x47785d
cmp eax, 0x1404
jae 0x47785d
mov edx, ebp
sub edx, esi
mov eax, esi
add edx, 0x109d2
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x477853
cmp dword [0x103a97c], edi
jne 0x477875
push esi
push str.Get_tc_BlackList_from_regedit_:___s_
push 0
call fcn.0043d500
add esp, 0xc
lea ecx, [esp + 0x44]
call sub.mfc90.dll_Ordinal_580
mov byte [esp + 0xa304], 0x3a
mov eax, dword [esp + 0x18]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x477bb7
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x4c]
call sub.mfc90.dll_Ordinal_6494
push 0
push 0x60
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_2480]
cmp eax, 0xffffffff
jne 0x477ad7
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push 0x5028fc
push edx
call fcn.00410070
add esp, 0xc
mov byte [esp + 0xa304], 0x3b
push eax
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x3c
lea ecx, [esp + 0x4c]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0x5028fc
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa314], 0x3d
mov byte [esp + 0xa314], 0x3a
call fcn.004d90e0
mov esi, dword [esp + 0x5c]
add esp, 0x10
test esi, esi
jle 0x477bb7
lea ecx, [ecx]
push 0x5028fc
mov ecx, 0x103ac64
call dword [sym.imp.mfc90.dll_Ordinal_945]
sub esi, 1
jne 0x477950
jmp 0x477bb7
mov ecx, dword [0x103ade4]
xor esi, esi
cmp ecx, edi
jle 0x477633
mov bl, 0x34
lea edi, [esi + 0x35]
nop
cmp esi, 0x400
jge 0x47762e
mov eax, dword [0x103ae0c]
cmp eax, esi
jle 0x4779af
test esi, esi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov eax, dword [0x103ae08]
lea eax, [eax + esi*4]
jmp 0x4779ca
push 0x5116d8
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], bl
or dword [esp + 0x28], 0x10
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0xa308], edi
test esi, esi
jl 0x476df2
cmp esi, dword [0x103ade4]
jge 0x476df2
mov ecx, dword [0x103ade0]
push ecx
lea eax, [ecx + esi*4]
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x36
mov byte [esp + 0xa30c], bl
call fcn.0044a7b0
add esp, 8
mov dword [esp + 0xa304], 8
test byte [esp + 0x28], 0x10
je 0x477a42
and dword [esp + 0x28], 0xffffffef
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp dword [0x103a97c], 0
je 0x477ac3
cmp dword [0x103ae0c], esi
jle 0x477a5e
mov edx, dword [0x103ae08]
mov eax, dword [edx + esi*4]
jmp 0x477a7c
push 0x5116d8
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 0x37
or dword [esp + 0x28], 0x20
mov eax, dword [eax]
cmp esi, dword [0x103ade4]
jge 0x476df2
push eax
mov eax, dword [0x103ade0]
mov ecx, dword [eax + esi*4]
push ecx
push esi
push str.g_EP_arData3__d___s__folder__s_
push 8
call fcn.0043d500
add esp, 0x14
mov dword [esp + 0xa304], 8
test byte [esp + 0x28], 0x20
je 0x477ac3
and dword [esp + 0x28], 0xffffffdf
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [0x103ade4]
inc esi
cmp esi, ecx
jl 0x477980
jmp 0x47762e
push 0
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x3e
lea eax, [esp + 0x4c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0x5028f0
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa314], 0x3f
mov byte [esp + 0xa314], 0x3a
call fcn.004d90e0
add esp, 0x10
cmp dword [esp + 0x4c], 0
jg 0x477b2e
call sub.mfc90.dll_Ordinal_1252
mov ecx, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x20]
push 0x5028fc
push edx
call fcn.00410070
add esp, 0xc
mov byte [esp + 0xa304], 0x40
push eax
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp dword [esp + 0x4c], 1
jg 0x477b77
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [esp + 0x48]
add eax, 4
push eax
lea eax, [esp + 0x20]
push 0x5028fc
push eax
call fcn.00410070
add esp, 0xc
mov byte [esp + 0xa304], 0x41
push eax
mov ecx, 0x103ac64
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [0x103add8]
cmp dword [ecx - 0xc], 0
je 0x477c52
push 0
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_899]
cmp al, 0x3a
je 0x477c52
push 0x103add8
lea edx, [esp + 0x20]
push 0x5028fc
push edx
call fcn.00410070
add esp, 0xc
mov byte [esp + 0xa304], 0x42
push eax
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x103ac64
lea eax, [esp + 0x24]
push 0x5028fc
push eax
call fcn.00410070
add esp, 0xc
mov byte [esp + 0xa304], 0x43
push eax
mov ecx, 0x103ac64
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [0x103add8]
cmp dword [eax - 0xc], 0
je 0x477c9a
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x477c60
sub eax, edx
dec eax
push eax
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_899]
cmp al, 0x3a
je 0x477c9a
push 0x5028fc
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_945]
push 0x5028fc
mov ecx, 0x103ac64
call dword [sym.imp.mfc90.dll_Ordinal_945]
cmp dword [0x103a97c], edi
jne 0x477cbf
mov ecx, dword [0x103ac64]
mov edx, dword [0x103add8]
push ecx
push edx
push str.g_tc_BlackList:___s_g_tc_BlackListVer:___s_
push 0
call fcn.0043d500
add esp, 0x10
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x4c]
call sub.mfc90.dll_Ordinal_6494
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_4477]
mov ecx, 0x103ac64
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push 0
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_899]
test al, al
je 0x477d3e
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x44
lea eax, [esp + 0x4c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0x5028fc
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa314], 0x45
mov byte [esp + 0xa314], 0x3a
call fcn.004d90e0
add esp, 0x10
test byte [0x1038f48], 4
je 0x477db1
mov eax, dword [esp + 0x4c]
xor esi, esi
test eax, eax
jle 0x477db1
cmp dword [0x103a97c], edi
jne 0x477d85
test esi, esi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + esi*4]
push edx
push esi
push str.m_sBlackList_member__d___s_
push 0
call fcn.0043d500
mov eax, dword [esp + 0x5c]
add esp, 0x10
test esi, esi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov eax, dword [esp + 0x48]
mov ecx, dword [ebx + 8]
lea eax, [eax + esi*4]
push eax
push ecx
mov ecx, ebx
call sub.mfc90.dll_Ordinal_6153
mov eax, dword [esp + 0x4c]
inc esi
cmp esi, eax
jl 0x477d51
mov ecx, dword [0x103add8]
cmp dword [ecx - 0xc], 2
jle 0x477dc6
cmp dword [ebp + 0x35994], 1
jge 0x477dd6
push 0x5116d8
mov ecx, 0x103add8
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x4c]
call sub.mfc90.dll_Ordinal_6494
push 0
mov ecx, 0x103ac64
call dword [sym.imp.mfc90.dll_Ordinal_899]
test al, al
je 0x477e3f
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x103ac64
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x46
lea edx, [esp + 0x4c]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0x5028fc
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa314], 0x47
mov byte [esp + 0xa314], 0x3a
call fcn.004d90e0
add esp, 0x10
test byte [0x1038f48], 4
je 0x477eb9
mov eax, dword [esp + 0x4c]
xor esi, esi
test eax, eax
jle 0x477eb9
cmp dword [0x103a97c], edi
jne 0x477e86
test esi, esi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + esi*4]
push ecx
push esi
push str.m_sBlackListVer_member__d___s_
push 0
call fcn.0043d500
mov eax, dword [esp + 0x5c]
add esp, 0x10
test esi, esi
jl 0x476df2
cmp esi, eax
jge 0x476df2
mov edx, dword [esp + 0x48]
lea eax, [edx + esi*4]
mov edx, dword [ebp + 0x359a8]
lea ecx, [ebp + 0x359a0]
push eax
push edx
call sub.mfc90.dll_Ordinal_6153
mov eax, dword [esp + 0x4c]
inc esi
cmp esi, eax
jl 0x477e52
mov eax, dword [ebp + 0x359a8]
cmp eax, dword [ebp + 0x35994]
je 0x477ef2
push 0xffffffffffffffff
push 0
lea ecx, [ebp + 0x359a0]
call sub.mfc90.dll_Ordinal_6494
mov eax, dword [0x103ac64]
mov ecx, dword [0x103add8]
push eax
push ecx
push str.Invalid_BlackList_member__m_sBlackListVer_clearedg_tc_BlackList:___s_g_tc_BlackListVer:___s_
push 0
call fcn.0043d500
add esp, 0x10
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_AD_INFO
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x477f23
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x4780ab
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x48
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0xa30c], 0x3a
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x49
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4780ab
cmp ecx, 0x64
jae 0x4780ab
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x151ee]
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x477fc0
lea ecx, [esp + 0x58]
call sub.mfc90.dll_Ordinal_580
mov bl, 0x4a
mov byte [esp + 0xa304], bl
push 0
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x4b
lea eax, [esp + 0x60]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0x5028fc
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa314], 0x4c
mov byte [esp + 0xa314], bl
call fcn.004d90e0
mov eax, dword [esp + 0x70]
add esp, 0x10
cmp eax, 2
je 0x47806c
mov ecx, dword [str.TrueCut]
mov dword [ebp + 0x15252], ecx
mov edx, dword [0x5135dc]
mov dword [ebp + 0x15256], edx
test eax, eax
jg 0x478050
call sub.mfc90.dll_Ordinal_1252
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
lea edx, [ebp + 0x15284]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x478060
jmp 0x47809a
mov esi, dword [esp + 0x5c]
mov ecx, dword [esi]
lea edx, [ebp + 0x15252]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x478078
mov ecx, dword [esi + 4]
lea edx, [ebp + 0x15284]
jmp 0x478090
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x478090
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x58]
call sub.mfc90.dll_Ordinal_781
push 0xa000
lea ecx, [esp + 0x2fc]
push ecx
push str.tc_OKMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4780dc
mov byte [esp + 0x2f8], 0
lea edx, [esp + 0x2f8]
push edx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x47817a
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x4d
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0xa30c], 0x3a
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x4e
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x47817a
cmp ecx, 0x200
jae 0x47817a
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x11dd6]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478170
push str.fb_messengermicrosoft_lyncmicrosoft_lync_2010skype_for_businessi_messenger_uclantalk.net_messengerbigant_messengercoolmessengerdaum
mov ecx, 0x103acd8
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, 0x103acd8
call dword [sym.imp.mfc90.dll_Ordinal_4477]
test dword [0x1038f48], 0x200
je 0x478347
cmp byte [esp + 0x2f8], 0
je 0x478347
push ecx
lea edx, [esp + 0x2fc]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa308], 0x4f
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0xa30c], 0x3a
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x50
mov eax, dword [esp + 0x30]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x47821a
cmp ecx, 0xa000
jae 0x47821a
lea edx, [esp + 0x2f8]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478210
lea ecx, [esp + 0x2f8]
push ecx
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa304], 0x51
lea ecx, [esp + 0x58]
call sub.mfc90.dll_Ordinal_580
mov bl, 0x52
mov byte [esp + 0xa304], bl
push 0
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa30c], 0x53
lea eax, [esp + 0x60]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0x5028fc
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa314], 0x54
mov byte [esp + 0xa314], bl
call fcn.004d90e0
mov edi, dword [esp + 0x70]
add esp, 0x10
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0xa304], 0x55
xor esi, esi
test edi, edi
jle 0x478301
lea esp, [esp]
test esi, esi
jl 0x476df2
cmp esi, dword [esp + 0x60]
jge 0x476df2
mov ecx, dword [esp + 0x5c]
mov edx, dword [ecx + esi*4]
cmp dword [edx - 0xc], 1
lea eax, [ecx + esi*4]
jl 0x4782fc
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
mov eax, dword [esp + 0x24]
push 0x5116d8
push eax
mov ecx, 0x103acd8
call dword [sym.imp.mfc90.dll_Ordinal_5924]
inc esi
cmp esi, edi
jl 0x4782b0
mov byte [esp + 0xa304], bl
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa304], 0x51
lea ecx, [esp + 0x58]
call sub.mfc90.dll_Ordinal_781
mov byte [esp + 0xa304], 0x50
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0xa000
lea ecx, [esp + 0x2fc]
push ecx
push str.tc_OKWebMail
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478378
mov byte [esp + 0x2f8], 0
lea edx, [esp + 0x2f8]
push edx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x47840f
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x56
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0xa30c], 0x3a
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x57
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x47840f
cmp ecx, 0x200
jae 0x47840f
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x11fd6]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478405
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_OKURL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478440
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x4784db
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x58
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0xa30c], 0x3a
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x59
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4784db
cmp ecx, 0x2800
jae 0x4784db
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x121d6]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4784d1
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_PopBlackMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47850c
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478542
cmp ecx, 0x64
jae 0x478542
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x14a9e]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478538
lea eax, [ebp + 0x14a9e]
mov edx, 0x1039750
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478550
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_PopMailMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47858b
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4785c1
cmp ecx, 0x64
jae 0x4785c1
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x14b02]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4785b7
lea eax, [ebp + 0x14b02]
mov edx, 0x1038f50
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4785d0
push 0xffffffffffffffff
push str.tc_Attachsize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push 0xffffffffffffffff
push str.tc_Bodysize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x825c], eax
call fcn.00491d40
push 0xffffffffffffffff
push str.tc_BodyAttachsize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8260], eax
call fcn.00491d40
push 0xa000
lea edx, [esp + 0x32c]
push edx
push str.tc_PopMailSizeMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8264], eax
call fcn.00491b30
add esp, 0x44
cmp eax, 0xffffffff
jne 0x47865f
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x47869a
cmp ecx, 0x64
jae 0x47869a
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x14b66]
jmp 0x478690
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478690
lea eax, [ebp + 0x14b66]
mov edx, 0x1039350
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4786a7
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_PopBlackURL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4786e2
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
xor eax, eax
jmp 0x478700
mov cl, byte [esp + eax + 0x2f8]
mov byte [eax + 0x1039b50], cl
inc eax
test cl, cl
jne 0x478700
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x47873a
cmp ecx, 0x64
jae 0x47873a
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x149d6]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478730
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_RedirectURL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47876b
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4787a1
cmp ecx, 0x64
jae 0x4787a1
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x14a3a]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478797
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ReqMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4787d2
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x47880a
cmp ecx, 0x64
jae 0x47880a
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x14ffa]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478800
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ReqServer
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47883b
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478871
cmp ecx, 0x32
jae 0x478871
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1505e]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478867
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ReqFrom
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4788a2
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4788da
cmp ecx, 0x32
jae 0x4788da
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x15090]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4788d0
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ReqTo
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47890b
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478941
cmp ecx, 0x32
jae 0x478941
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x150c2]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478937
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ReqSubject
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478972
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x4789aa
cmp ecx, 0x32
jae 0x4789aa
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x150f4]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4789a0
push 0
push str.tc_TrialDate
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491d40
push 0
push str.tc_TrialAlarmDate
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x8278], eax
call fcn.00491d40
add esp, 0x20
mov dword [ebp + 0x827c], eax
cmp dword [0x10430c0], 0
je 0x4789f5
or dword [0x104304c], 2
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ExpireMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478a26
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478a5c
cmp ecx, 0x64
jae 0x478a5c
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x15126]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478a52
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_WMI
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478a8d
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478aca
cmp ecx, 0x200
jae 0x478aca
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1e7d6]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478ac0
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_SendLargeLogTimeRange
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478afb
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478b31
cmp ecx, 0x64
jae 0x478b31
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x1bb7e]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478b27
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ExceptIP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478b62
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x478bfd
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x5a
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0xa30c], 0x3a
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x5b
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478bfd
cmp ecx, 0x400
jae 0x478bfd
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x92d8]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478bf3
push 0xa000
lea edx, [esp + 0x2fc]
push edx
push str.tc_ExceptURL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478c2e
mov byte [esp + 0x2f8], 0
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x478ce7
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x5c
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0xa30c], 0x3a
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x5d
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478cfc
cmp ecx, 0x800
jae 0x478cfc
mov ecx, ebp
sub ecx, eax
lea edx, [ecx + 0x82d8]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478cc0
lea edx, [esp + 0x34]
push edx
push 0
push 0
push 0x46f3d0
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
jmp 0x478cfc
push str.tc_ExceptURL_SRC
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push 0xa000
lea eax, [esp + 0x2fc]
push eax
push str.tc_CutExceptIP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478d2d
mov byte [esp + 0x2f8], 0
lea ecx, [esp + 0x2f8]
push ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], 0
je 0x478dca
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0xa308], 0x5e
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0xa30c], 0x3a
call fcn.0048eab0
add esp, 8
mov byte [esp + 0xa304], 0x5f
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa304], 0x3a
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x478dca
cmp ecx, 0x600
jae 0x478dca
mov edx, ebp
sub edx, eax
add edx, 0x8ad8
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x478dc0
push 0xa000
lea eax, [esp + 0x2fc]
push eax
push str.tc_RansomFileType
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x478dfd
mov byte [esp + 0x2f8], 0
jmp 0x478e0b
cmp byte [esp + 0x2f8], 0
jne 0x478eb1
cmp byte [0x103b0fc], 0
je 0x478eb1
lea eax, [esp + 0x2f8]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0xffffffffffffffff
push 0
mov ecx, 0x103ace0
call sub.mfc90.dll_Ordinal_6494
push 0xffffffffffffffff
push 0
mov ecx, 0x103ad28
call sub.mfc90.dll_Ordinal_6494
push 0xffffffffffffffff
push 0
mov ecx, 0x103abc8
call sub.mfc90.dll_Ordinal_6494
push 0xffffffffffffffff
push 0
mov ecx, 0x103abb4
call sub.mfc90.dll_Ordinal_6494
push str..hwp_.hwpx_.pdf_.doc_.ppt_.xls_.docx_.pptx_.xlsx
mov ecx, 0x103ad7c
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x479290
mov ecx, dword [esp + 0xa2fc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa2e4]
xor ecx, esp
call fcn.004e0148
add esp, 0xa2f4
ret