Function at 0x46ff90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x4ed4ec
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
xor ebx, ebx
mov dword [esp + 0x230], ebx
push ebx
call dword [sym.imp.MSVCR90.dll__time64]
add esp, 4
mov dword [esp + 0x18], eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], edx
call fcn.00409400
mov byte [esp + 0x230], 1
mov eax, dword [eax]
push eax
push str.tc_SaveConfigParam_time
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esi + 0x81fc]
push ecx
push str.tc_TCD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8290]
push edx
push str.tc_POPUP_DELAY_TIME
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x20
cmp dword [0x1038af8], ebx
jne 0x470096
mov eax, dword [esi + 0x828c]
push eax
push str.tc_log
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x10
mov ecx, dword [esi + 0x819c]
push ecx
push str.tc_CUT_POPUP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8294]
push edx
push str.tc_Cut_List
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x81a0]
push eax
push str.tc_COMMIT_POPUP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x81a4]
push ecx
push str.tc_COMMIT_LIST
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x81a8]
add esp, 0x40
push edx
push str.tc_COMMIT_LOG_SAVEFILE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x81ac]
push eax
push str.tc_PACK_POPUP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x81b0]
push ecx
push str.tc_DDOS_AP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x81b4]
push edx
push str.tc_StealthPatch
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x82c0]
add esp, 0x40
push eax
push str.tc_Sierra
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x81c4]
push ecx
push str.tc_UNINSTALL_PASSWORD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x1e9d8]
push edx
push str.tc_Finish_PASSWORD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x8298]
push eax
push str.tc_Cut_USB
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x829c]
add esp, 0x40
push ecx
push str.tc_EdrL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x81c8]
push edx
push str.tc_SPROCESS_EXP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x81cc]
push eax
push str.tc_SFILE_EXP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x81f4]
push ecx
push str.tc_TIME_AP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x81dc]
add esp, 0x40
push edx
push str.tc_BPRIVATEEYE_FOLDER
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x82c8]
push eax
push str.tc_PERFORMANCE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x8284]
push ecx
push str.tc_PCTIME
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x81d8]
push edx
push str.tc_PE_IE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x82c4]
add esp, 0x40
push eax
push str.tc_ADD
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x81ec]
push ecx
push str.tc_FTP_Folder
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x81f0]
push edx
push str.tc_DELBHO
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x82bc]
push eax
push str.tc_DELTOOLBAR
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x82a0]
add esp, 0x40
push ecx
push str.tc_NoINTERNET
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8288]
push edx
push str.tc_STEALTH
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x82a4]
push eax
push str.tc_CARE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x8204]
push ecx
push str.tc_ALLNOCUT
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x82ac]
add esp, 0x40
push edx
push str.tc_UNUSETYPE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x82a8]
push eax
push str.tc_ReadOnlyTYPE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x8228]
push ecx
push str.tc_W_L
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x81b8]
push edx
push str.tc_DDOS_POPUP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x81bc]
add esp, 0x40
push eax
push str.tc_DDOS_LIST
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x81c0]
push ecx
push str.tc_DDOS_LOG_SAVEFILE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x81f8]
push edx
push str.tc_DDOS_KILL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x82b0]
push eax
push str.tc_WTYPE
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x82b8]
add esp, 0x40
push ecx
push str.tc_Engine
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8268]
push edx
push str.tc_Option1
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x826c]
push eax
push str.tc_flt_set
push str.SOFTWARETrueCutTC_FLT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
lea ecx, [esi + 0x1518a]
push ecx
push str.tc_flt_search
push str.SOFTWARETrueCutTC_FLT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x40
push ecx
lea edx, [esi + 0x152b6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 2
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 3
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_USBExpList
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x14dfa]
add esp, 0x10
cmp byte [eax], bl
je 0x4705b6
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 4
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 5
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x4705c5
push 0x5116d8
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x10]
push eax
push str.tc_ExceptDeviceContext
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esi + 0x8208]
push ecx
push str.tc_DDX_H_Q
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x820c]
push edx
push str.tc_DDX_H_S
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x8210]
push eax
push str.tc_DDX_H_G
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x8214]
add esp, 0x40
push ecx
push str.tc_DDX_T_C
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8218]
push edx
push str.tc_DDX_T_S
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x821c]
push eax
push str.tc_DDX_U
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x8220]
push ecx
push str.tc_DDX_I
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8224]
add esp, 0x40
push edx
push str.tc_DDX_S
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x8230]
push eax
push str.tc_LogDelMonth
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x8234]
push ecx
push str.tc_LogDelSent
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8280]
push edx
push str.tc_SW_SF
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x8238]
add esp, 0x40
push eax
push str.tc_MaxLogSize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x823c]
push ecx
push str.tc_Speed
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8244]
push edx
push str.tc_WaterMark
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x8248]
push eax
push str.tc_WM_Height
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x824c]
add esp, 0x40
push ecx
push str.tc_WM_Blend
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8250]
push edx
push str.tc_WM_S_FontSize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x8258]
push eax
push str.tc_WM_S_FontWeight
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x8254]
push ecx
push str.tc_WM_S_FontColor
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x40
lea edx, [esi + 0x1090a]
push edx
push str.tc_WM_S_FontName
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x1096e]
push eax
push str.tc_WM_S_String
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esi + 0x81e0]
push ecx
push str.tc_DLL_Exp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x82d4]
push edx
push str.tc_SvrAgent
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x40
push ecx
lea eax, [esi + 0xf6d8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 6
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 7
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edx, dword [esp + 0x10]
push edx
push str.tc_SvrAgentDetectFolder
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0xf8d8]
push eax
push str.tc_SvrAgentScanTime
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea ecx, [esi + 0x1b51a]
push ecx
push str.tc_UserExpTitle
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x2c
lea edx, [esi + 0x1b57e]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 8
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 9
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_FileExtExp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x1b77e]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0xa
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0xb
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_FileExtCut
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x1b97e]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0xc
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0xd
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_EDRLTraceExt
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esi + 0x8270]
push edx
push str.tc_DefenderScanDay
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x8274]
push eax
push str.tc_DefenderScanTime
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x2c
lea edx, [esi + 0x1bdd6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0xe
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0xf
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_DefenderFolderExp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x1d1d6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x10
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x11
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_DefenderExtExp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x1d3d6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x12
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x13
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_DefenderProcessExp
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0xe6d8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x14
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x15
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_ExceptDLLs
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0xf90a]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x16
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x17
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_ForceCom
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x96d8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x18
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x19
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, str.tc_ExceptProcessEnable
cmp byte [0x103b0fc], bl
jne 0x470d16
mov eax, str.tc_ExceptProcess
mov ecx, dword [esp + 0x10]
push ecx
push eax
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x109d2]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x1a
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x1b
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_BlackList
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x151ee]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x1c
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x1d
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_AD_INFO
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x82d8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x1e
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x1f
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_ExceptURL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x8ad8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x20
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x21
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_CutExceptIP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x11dd6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x22
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x23
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_OKMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x11fd6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x24
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x25
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_OKWebMail
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x121d6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x26
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x27
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_OKURL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea edx, [esi + 0x14a9e]
push edx
push str.tc_PopBlackMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x14b02]
push eax
push str.tc_PopMailMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esi + 0x825c]
push ecx
push str.tc_Attachsize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x8260]
add esp, 0x40
push edx
push str.tc_Bodysize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x8264]
push eax
push str.tc_BodyAttachsize
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
lea ecx, [esi + 0x14b66]
push ecx
push str.tc_PopMailSizeMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea edx, [esi + 0x149d6]
push edx
push str.tc_PopBlackURL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x40
lea eax, [esi + 0x14a3a]
push eax
push str.tc_RedirectURL
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea ecx, [esi + 0x14ffa]
push ecx
push str.tc_ReqMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea edx, [esi + 0x1505e]
push edx
push str.tc_ReqServer
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x15090]
push eax
push str.tc_ReqFrom
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x40
lea ecx, [esi + 0x150c2]
push ecx
push str.tc_ReqTo
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea edx, [esi + 0x150f4]
push edx
push str.tc_ReqSubject
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov eax, dword [esi + 0x8278]
push eax
push str.tc_TrialDate
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x827c]
push ecx
push str.tc_TrialAlarmDate
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x40
lea edx, [esi + 0x15126]
push edx
push str.tc_ExpireMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x1e7d6]
push eax
push str.tc_WMI
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea ecx, [esi + 0x1bb7e]
push ecx
push str.tc_SendLargeLogTimeRange
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x2c
lea edx, [esi + 0x162b6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x28
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x29
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_RansomFileType
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0xc
lea edx, [esi + 0x164b6]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x2a
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x2b
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_WhiteList
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea edx, [esi + 0x1b4b6]
push edx
push str.tc_WhiteListMSG
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x14bca]
push eax
push str.tc_PopRansomMsg
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea ecx, [esi + 0x14c2e]
push ecx
push str.tc_BackUpFolder
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x40
lea edx, [esi + 0x14d32]
push edx
push str.tc_BackUpServer
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x14d96]
push eax
push str.tc_BackUpClearKey
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esi + 0x82b4]
push ecx
push str.tc_DetectType
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
movzx edx, byte [0x571aec]
push edx
push str.tc_SendLog2Manager
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x40
mov eax, dword [0x571ae8]
push eax
push str.tc_EachNoCut_Per
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [0x53e3dc]
push ecx
push str.tc_BackUpRoom
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
push 0x200
lea edx, [esp + 0x48]
push edx
push str.tc_RansomFileType_Old
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x34
cmp eax, 0xffffffff
jne 0x471429
mov byte [esp + 0x24], bl
jmp 0x471451
cmp byte [esp + 0x24], bl
je 0x471451
push 0x400
push ebx
push 0x1039f60
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x30]
push 0x1039f60
push eax
call fcn.0048e9b0
add esp, 0x14
push ecx
lea edx, [esi + 0x92d8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x2c
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x2d
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_ExceptIP
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esi + 0x8240]
push edx
push str.tc_BK_iFTP_Port
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
lea eax, [esi + 0x1bbe2]
add esp, 0x20
cmp byte [eax], bl
je 0x471536
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x2e
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x2f
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x471545
push 0x5116d8
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_BK_sFTP_UserID
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x1bc14]
add esp, 0x10
cmp byte [eax], bl
je 0x4715bb
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x30
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x31
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x4715ca
push 0x5116d8
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x10]
push eax
push str.tc_BK_sFTP_Pwd
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea ecx, [esi + 0x8138]
push ecx
push str.tc_sFTP_ServerIP
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea edx, [esi + 0x816a]
push edx
push str.tc_sNewServerIP
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x1bc46]
push eax
push str.tc_sScanTimeRange
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x40
lea ecx, [esi + 0x1bcaa]
push ecx
push str.tc_sScanFolder
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea edx, [esi + 0x1bd0e]
push edx
push str.tc_sScanFileExt
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x1bd72]
push eax
push str.tc_sScanClearKey
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x30
push 0x10db4e8
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x10]
push ecx
push str.tc_DDX_Server
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esi + 0x7f40]
push edx
push str.tc_Protocol
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x7f28]
push eax
push str.tc_Connect_Time
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x7f2c]
push ecx
push str.tc_CONTINUE_CONNECT
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x7f30]
add esp, 0x40
push edx
push str.tc_CONNECT_POLLING_TIME
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x7f10]
lea edi, [esi + 0x7f10]
push eax
push str.tc_DISPLAY_WEBIP
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x7f34]
push ecx
push str.tc_CUT_LOG_SEND_SERVER
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x7f14]
push edx
push str.tc_COMMIT_LOG_SEND_SERVER
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov eax, dword [esi + 0x7f3c]
add esp, 0x40
push eax
push str.tc_FILE_SEND_SERVER
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov ecx, dword [esi + 0x7f1c]
push ecx
push str.tc_DDOS_LOG_SEND_SERVER
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
mov edx, dword [esi + 0x7f20]
push edx
push str.tc_DumpFile_Send_Server
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
lea eax, [esi + 0x7f44]
push eax
push str.tc_PatchVersion
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x40
lea ecx, [esi + 0x7fa8]
push ecx
push str.tc_PatchTime
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea edx, [esi + 0x800c]
push edx
push str.tc_PatchTimeRange
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x8070]
push eax
push str.tc_Patch_PointServer
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esi + 0x7f38]
push ecx
push str.tc_iFTP_Port
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
lea eax, [esi + 0x80d4]
add esp, 0x40
cmp byte [eax], bl
je 0x4718b4
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x32
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x33
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x4718c3
push 0x5116d8
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x10]
push eax
push str.tc_sFTP_UserID
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
lea eax, [esi + 0x8106]
add esp, 0x10
cmp byte [eax], bl
je 0x471939
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x234], 0x34
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x238], bl
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x230], 0x35
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x471948
push 0x5116d8
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edx, dword [esp + 0x10]
push edx
push str.tc_sFTP_Pwd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
cmp byte [0x103a972], bl
je 0x471a3e
lea eax, [esp + 0x14]
push eax
push 0x16b00
lea ecx, [esp + 0x28]
push edi
push ecx
call fcn.00466670
mov byte [esp + 0x240], 0x36
mov eax, dword [esi + 0x35930]
mov ecx, dword [eax - 0xc]
lea edx, [esp + 0x24]
push edx
push ecx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00466670
add esp, 0x20
mov byte [esp + 0x230], 0x37
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x230], 0x36
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov esi, dword [esi + 0x359b4]
mov eax, dword [esi - 0xc]
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x20]
push esi
push edx
call fcn.00466670
add esp, 0x10
mov byte [esp + 0x230], 0x38
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x230], 0x36
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x20]
push eax
push str.tc_Hash
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
mov byte [esp + 0x230], bl
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x230], 0xffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004e0148
add esp, 0x224
ret