Function at 0x10020b41
Capabilities:
Check for time delay via gettickcount
Create thread
Terminate process

Disassembly:
sub esp, 0x60c
mov eax, dword [0x10084adc]
xor eax, esp
mov dword [esp + 0x608], eax
push ebx
push ebp
push esi
push edi
mov esi, 0x1ff
xor ebx, ebx
push esi
lea eax, [esp + 0x1d]
push ebx
push eax
mov byte [esp + 0x24], bl
call fcn.10045030
lea edi, [esi + 1]
push edi
lea eax, [esp + 0x28]
push eax
push str.TC_TCServer
mov ebp, str.SOFTWARETrueCut_tc_INSTALL
push ebp
push reloc.WS2_32.dll_bind
call fcn.100417d5
add esp, 0x20
cmp eax, 0xffffffff
jne 0x10020b9a
mov byte [esp + 0x18], bl
push esi
lea eax, [esp + 0x21d]
push ebx
push eax
mov byte [esp + 0x224], bl
call fcn.10045030
push edi
lea eax, [esp + 0x228]
push eax
push str.TC_PatchServer
push ebp
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.100417d5
add esp, 0x20
cmp eax, 0xffffffff
jne 0x10020bd9
mov byte [esp + 0x218], bl
lea eax, [esp + 0x18]
push 0x2e
push eax
mov byte [0x101580eb], 1
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x10020bf8
cmp byte [esp + 0x18], bl
jne 0x10020bfe
mov byte [0x101580eb], bl
lea eax, [esp + 0x218]
push 0x2e
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x10020c1c
cmp byte [esp + 0x218], bl
jne 0x10020c22
mov byte [0x101580eb], bl
cmp byte [0x101580eb], bl
je 0x10020ccd
mov esi, 0x81
push esi
mov ebp, 0x1014f518
push ebp
push str.PEeurT
push str.SoftwareTruecut
push reloc.WS2_32.dll_bind
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10020c61
push esi
push ebx
push ebp
call fcn.10045030
add esp, 0xc
push edi
mov esi, 0x1014df18
push esi
push str.PEeurTPEeurT
push str.SoftwareTruecut
push reloc.WS2_32.dll_bind
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10020c8f
push edi
push ebx
push esi
call fcn.10045030
add esp, 0xc
push 0x101131a8
push esi
push ebp
push ebx
call fcn.10035421
add esp, 0x10
push str.takeown
push 0x10155228
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10020cc3
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebp, str.SOFTWARETrueCut_tc_INSTALL
mov esi, reloc.WS2_32.dll_bind
push ebx
push str.TC_ServerType
push ebp
push esi
call fcn.10040ccf
push ebx
push str.tc_Log
push str.SOFTWARETrojanCut_tc_Env
push esi
mov dword [0x101580dc], eax
call fcn.10040ccf
add esp, 0x20
mov dword [0x1015668c], eax
cmp eax, ebx
je 0x10020d0b
push eax
push str.StartUp...g_bLog_0x_08x_
push ebx
call fcn.100412e2
add esp, 0xc
push 0x100687c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
push str.tc_PCTIME
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push esi
mov dword [esp + 0x24], eax
call fcn.10040ccf
mov ecx, eax
add esp, 0x10
and ecx, 0x40
mov dword [0x101580d8], eax
mov byte [0x102d3d90], bl
je 0x10020d78
test al, al
jns 0x10020d56
test edi, eax
je 0x10020d4f
test eax, 0x100
je 0x10020d71
test eax, 0x40000
jmp 0x10020d69
test eax, 0x8000
je 0x10020d64
test eax, 0x4000
je 0x10020d71
test eax, 0x4000000
mov byte [0x102d3d90], bl
je 0x10020d78
mov byte [0x102d3d90], 1
mov byte [0x102d3d91], bl
mov ebp, 0x10155428
cmp ecx, ebx
je 0x10020d9e
test al, al
jns 0x10020d90
shr eax, 0x12
jmp 0x10020d93
shr eax, 0x1a
and al, 1
mov byte [0x102d3d91], al
cmp al, bl
jne 0x10020dd2
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.10044b3d
add esp, 0xc
test eax, eax
je 0x10020dd2
mov eax, dword [0x1015668c]
cmp eax, 4
je 0x10020dc8
cmp eax, 0x99
jne 0x10021206
push str.IsProcessCritical_OK_noHook
jmp 0x100211fe
push 0x4100
push 0x10149e18
call fcn.10007867
push ebp
call fcn.1002f2b9
add esp, 0xc
test al, al
je 0x10020e04
cmp dword [0x1015668c], ebx
je 0x10021206
push str.isDefaultStaticWhite_OK_NOBHKOK
jmp 0x100211fe
mov ebp, 0x10155e28
push ebp
push 0x10155228
call fcn.10040391
push edi
push 0x10155a28
call fcn.10046cf2
push edi
push ebp
call fcn.10046cf2
add esp, 0x18
xor eax, eax
mov cl, byte [eax + 0x10155e28]
mov byte [eax + 0x10156028], cl
inc eax
cmp cl, bl
jne 0x10020e2b
push 0x10156028
call fcn.10045308
push ebx
push str.tc_logx
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.10040ccf
mov ebp, eax
add esp, 0x14
cmp ebp, ebx
je 0x10020ea6
push edi
lea eax, [esp + 0x41c]
push eax
push str.tc_logXp
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10020e88
mov byte [esp + 0x418], bl
lea eax, [esp + 0x418]
push eax
push 0x10155a28
call fcn.1004c839
pop ecx
pop ecx
test eax, eax
jne 0x10020ea6
mov dword [0x1015668c], ebp
call fcn.1000d583
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x2800
push ebx
push 0x1017e570
mov dword [0x10185a54], eax
call fcn.10045030
push 0x1000
push ebx
push 0x10180d78
call fcn.10045030
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x18
call ebp
push str.explorer.exeiexplore.exechrome.exewhale.exeswing.exeoutlook.exealzip.exebandizip.exebreadzip.exe7z.exewinrar.exewinzip.exewlmail.exemsimn.exemicrosoftedge.exemicrosoftedgecp.exefirefox.exeopera.exesafari.exewebkit2webprocess.exewscript.execscript.execonhost.execmd.exepowershell.exepowershell_ise.exeucbrowser.exespark.exe
mov dword [0x10151830], eax
call fcn.1002d947
push dword [0x10185a54]
call fcn.1002c4ff
push eax
mov dword [0x10185a58], eax
call fcn.1002c4ff
push eax
mov dword [0x10185a5c], eax
call fcn.1002c4ff
push eax
mov dword [0x10185a60], eax
call fcn.1002c4ff
add esp, 0x14
mov dword [0x10185a64], eax
cmp dword [0x101534e8], ebx
je 0x10020f80
mov ecx, 0x101534e8
cmp ecx, 0x10153560
jge 0x10020f80
mov eax, dword [ecx]
cmp eax, ebx
je 0x10020f80
cmp eax, dword [0x10185a58]
jne 0x10020f5b
mov dword [0x10185a58], ebx
mov dword [0x10185a5c], ebx
mov dword [0x10185a60], ebx
jmp 0x10020f73
cmp eax, dword [0x10185a5c]
je 0x10020f4d
cmp eax, dword [0x10185a60]
je 0x10020f53
cmp eax, dword [0x10185a64]
jne 0x10020f79
mov dword [0x10185a64], ebx
add ecx, 4
cmp dword [ecx], ebx
jne 0x10020f31
or dword [0x101487e4], 0xffffffff
push edi
push ebx
push 0x10157ea8
call fcn.10007858
add esp, 0xc
cmp dword [esp + 0x14], ebx
je 0x100211f1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101580f0], eax
call ebp
mov edi, eax
push edi
call fcn.1002c57b
test eax, eax
pop ecx
setne al
push edi
mov byte [0x1015188b], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1015668c]
cmp eax, ebx
je 0x10020fdf
push eax
push str.StartUp10...g_bLog_0x_08x_
push ebx
call fcn.100412e2
add esp, 0xc
cmp dword [str._trojancut.exe], ebx
je 0x1002102a
mov edi, 0x10083e38
cmp edi, 0x10083eb4
jge 0x1002102a
mov eax, dword [edi]
cmp byte [eax], bl
je 0x10021023
push eax
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10021023
push 0x10066bdc
push 0x10155228
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100211e2
add edi, 4
cmp dword [edi], ebx
jne 0x10020fec
mov eax, dword [0x1015668c]
cmp eax, ebx
je 0x10021042
push eax
push str.StartUp11...g_bLog_0x_08x_
push ebx
call fcn.100412e2
add esp, 0xc
mov eax, dword [0x10078cd8]
and eax, 0xf0000
mov dword [0x101580f4], eax
xor eax, eax
mov word [0x10078cda], ax
mov eax, dword [0x1015668c]
cmp eax, ebx
je 0x10021071
push eax
push str.StartUp12...g_bLog_0x_08x_
push ebx
call fcn.100412e2
add esp, 0xc
call fcn.1001132d
test al, al
je 0x10021206
cmp dword [0x1015668c], ebx
je 0x100210c6
push dword [0x10185a54]
push dword [0x10185a58]
push dword [0x10185a5c]
push dword [0x10185a60]
push dword [0x10185a64]
push 0x10154e28
push 0x10155e28
push 0x10155228
push 0x10155a28
push str.CInjectAPI_Start_g_szMyExeName__s___g_szMyExeFullPath__s___g_szMyExePath__s___g_szDllPath__s_ParentID__d___d___d___d___d_
push ebx
call fcn.100412e2
add esp, 0x2c
call fcn.100315fc
test eax, eax
je 0x10021206
call fcn.1001e856
mov eax, dword [0x1015668c]
cmp eax, ebx
je 0x100210f0
push eax
push str.StartUp13...g_bLog_0x_08x_
push ebx
call fcn.100412e2
add esp, 0xc
push str..scr
push 0x10155628
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1002111a
push 1
push str.tc_Scr
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.10041a19
add esp, 0x10
cmp dword [0x101580c0], ebx
je 0x1002112d
push 0x101143a8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [0x101580b8], ebx
je 0x10021140
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101505f4], eax
cmp byte [0x1014fdb9], bl
jne 0x10021159
cmp byte [0x1015788a], bl
je 0x10021198
test byte [0x10151864], 0x10
jne 0x10021198
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1000df71
push ebx
push ebx
mov byte [0x1015162f], bl
call fcn.1004592d
add esp, 0x18
mov dword [0x10151878], eax
cmp byte [0x101580eb], bl
je 0x10021198
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1000dedb
push ebx
push ebx
call fcn.1004592d
add esp, 0x18
test dword [0x10157880], 0x80000000
jne 0x100211c3
cmp dword [0x10157874], 2
je 0x100211c3
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1001e57b
push ebx
push ebx
call fcn.1004592d
add esp, 0x18
mov eax, dword [0x1015668c]
cmp eax, ebx
je 0x100211db
push eax
push str.StartUp14...g_bLog_0x_08x_
push ebx
call fcn.100412e2
add esp, 0xc
mov eax, 0x89578da3
jmp 0x1002120b
cmp dword [0x1015668c], ebx
je 0x10021206
push str.OK_NOBHKOK_Except_Hook2
jmp 0x100211fe
cmp dword [0x1015668c], ebx
je 0x10021206
push str.OK_NOBHKOK_StartUp_hMod_error
push ebx
call fcn.100412e2
pop ecx
pop ecx
mov eax, 0x23785289
mov ecx, dword [esp + 0x618]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004501f
add esp, 0x60c
ret