Function at 0x1001132d
Capabilities:
Accept command line arguments
Create thread
Inspect section memory permissions
Resolve function by parsing pe exports
Terminate process
Terminate thread

Disassembly:
mov eax, 0x15a48
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, esp
mov dword [esp + 0x15a44], eax
push ebx
push ebp
push esi
push edi
call fcn.10011309
mov byte [0x10151895], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
push ebx
mov dword [esp + 0x2c], ebx
call fcn.10045308
mov esi, 0x10155628
mov dword [esp], str.tc_setup.exe
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001147a
push str.tc_un.exe
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001147a
push str.tc_un2.exe
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001147a
push str.spoolsv.exe
push esi
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100113c3
mov byte [0x1014fdb9], 1
call fcn.1000eb4f
push str._k_netsvcs__p__s_wpnservice
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001147a
push str._k_localsystemnetworkrestricted__p__s_audioendpointbuilder
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001147a
xor esi, esi
mov ebp, 0x10060ec9
cmp dword [0x1015668c], esi
je 0x10011424
mov eax, dword [0x10178770]
cmp eax, esi
jne 0x1001140c
mov eax, ebp
mov ecx, ebx
cmp ebx, esi
jne 0x10011414
mov ecx, ebp
push eax
push ecx
push str.GetCommandLine__s_GetExpCmdLine__s_...
push esi
call fcn.100412e2
add esp, 0x10
xor edi, edi
cmp ebx, esi
je 0x10011495
cmp byte [ebx], 0
je 0x10011495
mov eax, dword [edi*4 + 0x10178770]
cmp eax, esi
je 0x10011495
cmp edi, 0x200
jge 0x10011495
cmp byte [eax], 0
je 0x10011454
push eax
push ebx
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10011457
inc edi
jmp 0x1001142a
cmp dword [0x1015668c], esi
je 0x1001147a
mov eax, dword [edi*4 + 0x10178770]
push eax
movsx eax, byte [eax]
push eax
push edi
push str.OK_NOBHKOK_Except_CommandLine_Hook1__d___c___s_
push esi
call fcn.100412e2
add esp, 0x14
xor al, al
mov ecx, dword [esp + 0x15a54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004501f
add esp, 0x15a48
ret
call fcn.1000e92e
push 0x104
lea eax, [esp + 0x1354]
push esi
push eax
call fcn.10045030
add esp, 0xc
cmp dword [0x10176b70], esi
je 0x100114ce
push esi
lea eax, [esp + 0x1354]
push eax
push 0x10155228
call fcn.10035824
add esp, 0xc
mov edi, 0x10176b70
cmp byte [esp + 0x1350], 0
je 0x10011527
mov eax, dword [edi]
cmp eax, esi
je 0x10011527
cmp edi, 0x10177370
jge 0x10011527
cmp byte [eax], 0
je 0x10011504
push eax
lea eax, [esp + 0x1354]
push eax
call fcn.1004c839
pop ecx
pop ecx
test eax, eax
je 0x10011509
add edi, 4
jmp 0x100114d3
cmp dword [0x1015668c], esi
je 0x1001147a
push str.OK_NOBHKOK_Except_GetHashFileSHA_256_Hook1
push esi
call fcn.100412e2
pop ecx
pop ecx
jmp 0x1001147a
call fcn.1000ee14
cmp dword [0x1015668c], esi
je 0x1001154e
mov eax, dword [0x10173b70]
cmp eax, esi
jne 0x1001153f
mov eax, ebp
push eax
push str.GetExpDefault__s_...
push esi
call fcn.100412e2
add esp, 0xc
cmp dword [0x10173b70], esi
je 0x10011586
mov edi, 0x10173b70
cmp edi, 0x10174370
jge 0x10011586
mov eax, dword [edi]
cmp byte [eax], 0
je 0x1001157f
push eax
push 0x10155628
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001195e
add edi, 4
cmp dword [edi], esi
jne 0x1001155b
push 0x9fff
lea eax, [esp + 0x1a59]
push esi
push eax
mov byte [esp + 0x1a60], 0
call fcn.10045030
push 0x4fff
lea eax, [esp + 0x10a65]
push esi
push eax
mov byte [esp + 0x10a6c], 0
call fcn.10045030
push 6
push str.tc_Protocol
mov edi, str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push edi
mov ebp, reloc.WS2_32.dll_bind
push ebp
call fcn.10040ccf
push esi
push str.tc_CUT_LOG_SEND_SERVER
push edi
push ebp
mov dword [0x10151870], eax
call fcn.10040ccf
push esi
push str.tc_Option1
mov ebx, str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push ebx
push ebp
mov dword [0x10151874], eax
call fcn.10040ccf
add esp, 0x48
push esi
push str.tc_EdrL
push ebx
push ebp
mov dword [0x10151864], eax
call fcn.10040ccf
push 0x200
mov edi, 0x10120dd0
push edi
mov dword [0x10151868], eax
call fcn.10007867
push 0x200
push edi
push str.tc_GW
push str.SOFTWARETrojanCut_tc_Env
push ebp
call fcn.100417d5
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x1001164c
mov byte [0x10120dd0], 0
mov edi, 0xa000
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a60]
push eax
push str.tc_EDRLTraceExt
push ebx
push ebp
call fcn.100417d5
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10011684
mov byte [esp + 0x1a54], 0
push 0x200
mov edi, 0x10169550
push edi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x100116ce
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.100409eb
pop ecx
pop ecx
cmp dword [0x1015668c], esi
je 0x100116c7
push edi
push str.tc_EDRLTraceExt_:__s
push esi
call fcn.100412e2
add esp, 0xc
push edi
call fcn.10045308
pop ecx
push str.office16
mov edi, 0x10155428
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100116f5
push str.office19
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100116fc
mov byte [0x101580b1], 1
push 0x400
push esi
push 0x10113ba8
call fcn.10045030
add esp, 0xc
test byte [0x10151868], 1
jne 0x10011727
cmp byte [0x101580b1], 0
je 0x10011981
xor esi, esi
xor eax, eax
lea edi, [esp + 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push dword [0x10185a54]
movzx eax, word [esp + 0x3c]
push eax
movzx eax, word [esp + 0x3e]
push eax
movzx eax, word [esp + 0x40]
push eax
movzx eax, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x44]
push eax
push str._04d__02d__02d__02d:_02d:_02d__d
push 0x1014e918
call fcn.10045378
add esp, 0x24
test byte [0x10151868], 0x10
je 0x100117cc
push esi
push dword [esp + 0x2c]
push 0x10155228
push 0x1000
call fcn.10038b4c
add esp, 0x10
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x3ff
mov dword [esp + 0x20], eax
lea eax, [esp + 0x8f1]
push esi
push eax
mov byte [esp + 0x8f8], 0
call fcn.10045030
add esp, 0xc
cmp dword [esp + 0x1c], esi
je 0x10011974
xor eax, eax
inc eax
cmp dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle 0x10011952
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x10011940
cmp word [eax], 0
je 0x10011940
xor esi, esi
push esi
push esi
push 0x400
lea ecx, [esp + 0x8f8]
push ecx
push 0xffffffffffffffff
push eax
push esi
push esi
call fcn.1004491a
add esp, 0x20
xor eax, eax
mov cl, byte [esp + eax + 0x8ec]
mov byte [esp + eax + 0xcec], cl
inc eax
test cl, cl
jne 0x1001185c
lea esi, [esp + 0xcec]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001187b
sub eax, edx
cmp eax, 2
jbe 0x100118d1
cmp byte [esp + 0xcec], 0x22
jne 0x100118d1
lea eax, [esp + 0xcec]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001189d
sub eax, edx
lea edi, [esp + 0xcec]
dec edi
cmp byte [eax + edi], 0x22
jne 0x100118d1
lea eax, [esp + 0xcec]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100118be
sub eax, edx
mov byte [eax + edi], cl
lea esi, [esp + 0xced]
push esi
call fcn.10040ad7
pop ecx
test eax, eax
je 0x10011940
cmp byte [0x101580b1], 0
je 0x100118fc
push esi
call fcn.1000770a
pop ecx
push eax
push 0
push 0
push esi
mov ecx, 0x10189098
call fcn.1002b9a3
cmp dword [0x1015668c], 0x48
jne 0x10011915
push esi
push str.SendInfoDisplayEDRL_GetCommandLineW_:___s_
push 0
call fcn.100412e2
add esp, 0xc
test byte [0x10151868], 1
je 0x10011940
mov edx, 0x10113ba8
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10011927
push 1
push 0
push esi
push 1
call fcn.10038628
add esp, 0x10
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
jl 0x1001181f
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10011981
cmp dword [0x1015668c], esi
je 0x1001147a
push str.OK_NOBHKOK_Except_Default_Hook1
jmp 0x1001151a
push str.errr_CommandLineToArgvW_null
push esi
call fcn.100412e2
pop ecx
pop ecx
xor esi, esi
push esi
push str.tc_Cut_List
push ebx
push ebp
call fcn.10040ccf
add esp, 0x10
test dword [0x10151864], 0x800
mov dword [0x1015186c], eax
mov byte [0x1015786b], 0
je 0x100119b6
test al, 2
jne 0x100119b6
mov byte [0x1015786b], 1
cmp dword [0x1015668c], esi
je 0x100119d4
movzx eax, byte [0x1015786b]
push eax
push str.g_bBackUp___d_
push esi
call fcn.100412e2
add esp, 0xc
push esi
push str.tc_DEMO
push str.SOFTWARETrojanCut_tc_Env
push ebp
call fcn.10040ccf
push esi
push str.tc_Add
push ebx
push ebp
mov dword [0x102bfd64], eax
call fcn.10040ccf
add esp, 0x20
mov dword [0x10154a1c], eax
cmp eax, 0x40
jae 0x10011a0a
mov dword [0x10154a1c], esi
push esi
push str.tc_PCTIME
push ebx
push ebp
call fcn.10040ccf
add esp, 0x10
mov dword [0x101580d8], eax
cmp dword [0x1015668c], esi
je 0x10011c4f
mov esi, 0x100651c8
test al, 0x40
mov edi, 0x100651c4
mov eax, esi
jne 0x10011a3d
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL___s_
push 0
call fcn.100412e2
add esp, 0xc
test byte [0x101580d8], 0x80
mov eax, esi
jne 0x10011a5a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x40000
mov eax, esi
jne 0x10011a7a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_HIGHST__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x100
mov eax, esi
jne 0x10011a9a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_MID__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x200
mov eax, esi
jne 0x10011aba
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_HIGH__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x1000000
mov eax, esi
jne 0x10011ada
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_HIGHST__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x400
mov eax, esi
jne 0x10011afa
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_MID__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x800
mov eax, esi
jne 0x10011b1a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_HIGH__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x2000000
mov eax, esi
jne 0x10011b3a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_HIGHST__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x1000
mov eax, esi
jne 0x10011b5a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_MID__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x2000
mov eax, esi
jne 0x10011b7a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_HIGH__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x4000000
mov eax, esi
jne 0x10011b9a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_HIGHST__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x4000
mov eax, esi
jne 0x10011bba
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_MID__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x8000
mov eax, esi
jne 0x10011bda
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_HIGH__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x8000000
mov eax, esi
jne 0x10011bfa
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_HIGHST__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x10000
mov eax, esi
jne 0x10011c1a
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_MID__s_
push 0
call fcn.100412e2
add esp, 0xc
test dword [0x101580d8], 0x20000
jne 0x10011c38
mov esi, edi
push esi
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_HIGH__s_
push 0
call fcn.100412e2
mov eax, dword [0x101580d8]
add esp, 0xc
xor esi, esi
mov edx, 0x1111
test al, 0x40
je 0x10011cef
test al, al
jns 0x10011c90
mov ecx, eax
and ecx, 0x200
je 0x10011c71
test eax, 0x100
jne 0x10011cef
cmp ecx, esi
je 0x10011c7d
or dword [0x10150600], edx
jmp 0x10011cf9
test eax, 0x40000
jne 0x10011cda
or dword [0x10150600], 0x1014
jmp 0x10011cf9
mov edi, 0x1000
or dword [0x10150600], edi
test eax, 0x1000000
je 0x10011cac
and dword [0x10150600], 0xffffefff
mov ecx, eax
and ecx, 0x2000
je 0x10011cc3
test edi, eax
je 0x10011cc3
or dword [0x10150600], 0x12
jmp 0x10011cf9
cmp ecx, esi
je 0x10011cd3
or dword [0x10150600], 0x111
jmp 0x10011cf9
test eax, 0x2000000
je 0x10011ce6
or dword [0x10150600], 0x101
jmp 0x10011cf9
or dword [0x10150600], 0x14
jmp 0x10011cf9
or dword [0x10150600], 0x1012
mov ecx, dword [0x101580c0]
cmp ecx, esi
je 0x10011d0e
cmp ecx, 0x40
jae 0x10011d0e
mov dword [0x10150600], edx
cmp dword [0x1015668c], esi
je 0x10011db9
push dword [0x10150600]
push eax
push str.g_tc_PCTIME_0x_08x__g_TC_SECURITY_0x_08x_
push esi
call fcn.100412e2
add esp, 0x10
test byte [0x10150600], 1
je 0x10011d45
push str.TC_SECURITY_COMM_RAW_on
push esi
call fcn.100412e2
pop ecx
pop ecx
test byte [0x10150600], 2
je 0x10011d5b
push str.TC_SECURITY_COMM_NOR_on
push esi
call fcn.100412e2
pop ecx
pop ecx
test byte [0x10150600], 4
je 0x10011d71
push str.TC_SECURITY_COMM_LOW_on
push esi
call fcn.100412e2
pop ecx
pop ecx
test byte [0x10150600], 0x10
je 0x10011d87
push str.TC_SECURITY_FLT_FILE_on
push esi
call fcn.100412e2
pop ecx
pop ecx
test dword [0x10150600], 0x100
je 0x10011da0
push str.TC_SECURITY_FLT_PACKET_128byte
push esi
call fcn.100412e2
pop ecx
pop ecx
test dword [0x10150600], 0x1000
je 0x10011db9
push str.TC_SECURITY_FLT_LOG_10sec
push esi
call fcn.100412e2
pop ecx
pop ecx
push str.MIN_FILE_SIZE
push 0x400
mov eax, 0x100
push 0x200
push eax
push eax
call fcn.1000150f
mov edi, str.sLog_tmpnAttackRateVal
push edi
mov esi, 0x190
push esi
push 0x12c
push 0xc8
push 0x64
mov dword [0x100dc0a4], eax
call fcn.1000150f
push edi
mov dword [0x1014fde0], eax
push esi
mov eax, 0xc8
push eax
push eax
push 0x64
call fcn.1000150f
push edi
push 0xfa0
push 0x7d0
push 0x3e8
push 0x1f4
mov dword [0x10078490], eax
call fcn.1000150f
add esp, 0x50
push 2
push str.tc_STEALTH
push ebx
push ebp
mov dword [0x1007848c], eax
call fcn.10040ccf
add esp, 0x10
mov dword [0x10078cd0], eax
test eax, 0xff000000
je 0x10011e57
and eax, 0xfffffff8
mov dword [0x10078cd0], eax
push 0
push str.tc_SvrAgent
push ebx
push ebp
call fcn.10040ccf
push 2
push str.tc_Sierra
push ebx
push ebp
mov dword [0x10151cb4], eax
call fcn.10040ccf
or edi, 0xffffffff
push edi
push str.tc_Attachsize
push ebx
push ebp
mov dword [0x10151cb0], eax
call fcn.10040ccf
push edi
push str.tc_Bodysize
push ebx
push ebp
mov dword [0x101580d4], eax
call fcn.10040ccf
add esp, 0x40
push edi
push str.tc_BodyAttachsize
push ebx
push ebp
mov dword [0x101580e0], eax
call fcn.10040ccf
mov dword [0x101580e4], eax
mov esi, 0xa000
push esi
lea eax, [esp + 0x1a68]
push eax
push str.tc_Dec
push ebx
push ebp
call fcn.100417d5
add esp, 0x24
cmp eax, edi
jne 0x10011ee2
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
je 0x10011f45
lea eax, [esp + 0x1a54]
push 0x10148804
push eax
call fcn.100409eb
pop ecx
pop ecx
xor eax, eax
mov cl, byte [eax + 0x10148804]
mov byte [esp + eax + 0x1a54], cl
inc eax
test cl, cl
jne 0x10011f02
lea eax, [esp + 0x1a54]
push eax
push str._s.doc
push 0x101487f0
call fcn.10045378
lea eax, [esp + 0x1a60]
push eax
push str._s.jpg
push 0x10148804
call fcn.10045378
add esp, 0x18
push esi
lea eax, [esp + 0x1a58]
push eax
push str.tc_OKMsg
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
jne 0x10011f69
mov byte [esp + 0x1a54], 0
push 0x200
push 0x10156428
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10011f98
lea eax, [esp + 0x1a54]
push 0x10156428
push eax
call fcn.100409eb
pop ecx
pop ecx
push esi
lea eax, [esp + 0x1a58]
push eax
push str.tc_OKWebMail
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
jne 0x10011fbc
mov byte [esp + 0x1a54], 0
push 0x200
mov esi, 0x1016fd70
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10011fe8
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.100409eb
pop ecx
pop ecx
xor esi, esi
push esi
push str.tc_NoINTERNET
push ebx
push ebp
call fcn.10040ccf
push esi
push str.tc_UNUSETYPE
push ebx
push ebp
mov dword [0x10157878], eax
call fcn.10040ccf
push esi
push str.tc_ReadOnlyTYPE
push ebx
push ebp
mov dword [0x1015787c], eax
call fcn.10040ccf
push 0x12014000
push str.tc_WTYPE
push ebx
push ebp
mov dword [0x10157890], eax
call fcn.10040ccf
add esp, 0x40
mov dword [0x10157880], eax
test eax, eax
js 0x1001209f
test dword [0x10078cd0], 0x100000
je 0x10012089
cmp dword [0x10152cdc], 0x10000
jae 0x10012089
cmp byte [0x1015788a], 0
jne 0x10012089
cmp byte [0x10151897], 0
jne 0x10012089
cmp dword [0x102b5a48], esi
je 0x10012089
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 2
push 0x179f
push dword [0x102b5a48]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x1001209f
cmp byte [eax], 0
je 0x1001209f
push eax
push esi
call fcn.10035bf2
pop ecx
pop ecx
mov esi, 0x2800
push esi
mov edi, 0x10178f70
push edi
call fcn.10007867
push 0x1000
push 0x1017b770
call fcn.10007867
push esi
push 0x1016ff70
call fcn.10007867
push 0x64
push 0x10181de0
call fcn.10007867
add esp, 0x20
test dword [0x10157880], 0x10000000
mov esi, 0x5000
jne 0x100122f4
push 0xa000
lea eax, [esp + 0x1a58]
push eax
push str.tc_OKURL
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10012117
mov byte [esp + 0x1a54], 0
push esi
lea eax, [esp + 0xba58]
push eax
push str.tc_OKURLForm
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001213c
mov byte [esp + 0xba54], 0
cmp byte [esp + 0x1a54], 0
jne 0x10012154
cmp byte [esp + 0xba54], 0
je 0x100122cb
lea eax, [esp + 0x10a54]
push esi
push eax
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012185
lea eax, [esp + 0x10a54]
push eax
lea eax, [esp + 0x1a58]
push eax
call fcn.100409eb
pop ecx
pop ecx
cmp byte [esp + 0xba54], 0
je 0x100121df
cmp byte [esp + 0x1a54], 0
je 0x100121b5
lea edi, [esp + 0x10a54]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100121a1
mov esi, 0x10063758
movsw word es:[edi], word [esi]
mov edi, 0x10178f70
lea eax, [esp + 0x10a54]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100121bf
sub eax, edx
lea eax, [esp + eax + 0x10a54]
push eax
lea eax, [esp + 0xba58]
push eax
call fcn.100409eb
pop ecx
pop ecx
xor eax, eax
mov cl, byte [esp + eax + 0x10a54]
mov byte [eax + 0x10178f70], cl
inc eax
test cl, cl
jne 0x100121e1
cmp dword [0x1015668c], 0
je 0x1001220c
push edi
push str.TYPE_INTERNETURL_g_tc_OKURL_List___s_
push 0
call fcn.100412e2
add esp, 0xc
mov dword [0x1017b770], edi
xor edi, edi
lea eax, [esp + 0x10a54]
inc edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001221f
sub eax, esi
cmp eax, edi
jbe 0x1001226b
mov esi, 0x1017b774
cmp esi, 0x1017c770
jge 0x1001226b
lea eax, [edi + 0x10178f71]
cmp byte [eax - 1], 0x3a
jne 0x10012253
cmp byte [eax], 0
mov byte [eax - 1], 0
je 0x10012253
mov dword [esi], eax
add esi, 4
lea eax, [esp + 0x10a54]
inc edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001225e
sub eax, edx
cmp edi, eax
jb 0x10012231
xor edi, edi
cmp dword [0x1015668c], edi
je 0x100122aa
cmp dword [0x1017b770], edi
je 0x100122aa
mov esi, 0x400
cmp edi, esi
jge 0x100122af
push dword [edi*4 + 0x1017b770]
push edi
push str.g_ptc_OKURL_List___d___s_
push 0
call fcn.100412e2
add esp, 0x10
inc edi
cmp dword [edi*4 + 0x1017b770], 0
jne 0x10012282
jmp 0x100122af
mov esi, 0x400
lea eax, [esp + 0x10a54]
push eax
push 0x10064c88
push 0x1016ff70
call fcn.10045378
add esp, 0xc
jmp 0x100122d0
mov esi, 0x400
push 0x64
push 0x10181de0
push str.tc_RedirectURL
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100122f9
mov byte [0x10181de0], 0
jmp 0x100122f9
mov esi, 0x400
cmp byte [0x1015788a], 0
je 0x10012328
push 0x64
push 0x10181de0
push str.tc_RedirectURL
push ebx
push ebp
call fcn.100417d5
or edi, 0xffffffff
add esp, 0x14
cmp eax, edi
jne 0x1001232b
mov byte [0x10181de0], 0
jmp 0x1001232b
or edi, 0xffffffff
push 0x64
push 0x10181d78
push str.tc_PopBlackURL
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
jne 0x1001234c
mov byte [0x10181d78], 0
push 0x64
push 0x10156628
push str.tc_PopMailMsg
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
jne 0x1001236d
mov byte [0x10156628], 0
push 0x64
push 0x10156690
push str.tc_PopMailSizeMsg
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
jne 0x1001238e
mov byte [0x10156690], 0
push 0x64
push 0x101566f8
push str.tc_PopRansomMsg
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
jne 0x100123af
mov byte [0x101566f8], 0
push 0x104
push 0x10156760
push str.tc_BackUpFolder
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
jne 0x100123d3
mov byte [0x10156760], 0
cmp byte [0x101580eb], 0
push esi
push 0x101588f8
push str.tc_sLocalIP
je 0x10012422
push str.SoftwareTruecut
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
jne 0x10012400
mov byte [0x101588f8], 0
push esi
push 0x10158cf8
push str.tc_sWebIP
push str.SoftwareTruecut
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, edi
mov edi, str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
jmp 0x10012455
mov edi, str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push edi
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001243d
mov byte [0x101588f8], 0
push esi
push 0x10158cf8
push str.tc_sWebIP
push edi
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001245e
mov byte [0x10158cf8], 0
push esi
push 0x101580f8
push str.TC_User_name
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10012483
mov byte [0x101580f8], 0
push esi
push 0x101584f8
push str.TC_User_office
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100124a8
mov byte [0x101584f8], 0
mov al, byte [0x101584f8]
test al, al
je 0x100124b5
cmp al, 0x20
jne 0x100124da
push esi
push 0x101584f8
push str.TC_Org
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100124da
mov byte [0x101584f8], 0
mov al, byte [0x101584f8]
test al, al
je 0x100124e7
cmp al, 0x20
jne 0x1001250c
push esi
push 0x101584f8
push str.TC_Section
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001250c
mov byte [0x101584f8], 0
cmp dword [0x102bfd64], 0
jne 0x1001252b
test dword [0x101580d8], 0x40000
mov dword [0x10083948], 0x3c
je 0x10012535
mov dword [0x10083948], 5
push 3
push str.tc_TCD
push ebx
push ebp
call fcn.10040ccf
add esp, 0x10
mov dword [0x10078cdc], eax
test eax, eax
jne 0x10012559
mov dword [0x10078cdc], 1
push 0x2000
push str.tc_FILE_SEND_SERVER
push edi
push ebp
call fcn.10040ccf
push 5
push str.tc_CONNECT_POLLING_TIME
push edi
push ebp
mov dword [0x10078cc0], eax
call fcn.10040ccf
push 1
push str.tc_FILE_EXP
push ebx
push ebp
mov dword [0x10078cd4], eax
mov byte [0x10078cba], 0
call fcn.10040ccf
push 0
push str.tc_CARE
test eax, eax
setne al
push ebx
push ebp
mov byte [0x1015496b], al
call fcn.10040ccf
mov dword [0x1015786c], eax
shr eax, 0x14
and eax, 0xf
add esp, 0x40
imul eax, eax, 0xa
push 0
push str.tc_ALLNOCUT
push ebx
push ebp
mov dword [0x10157870], eax
call fcn.10040ccf
push 0
push str.tc_PER
push ebx
push ebp
mov dword [0x10157874], eax
call fcn.10040ccf
push 0
push str.tc_EachNoCut_Per
test eax, eax
setne al
push ebx
push ebp
mov byte [0x10157889], al
call fcn.10040ccf
push 0x14
push str.tc_DDX_H_Q
push ebx
push ebp
mov dword [0x101505fc], eax
call fcn.10040ccf
add esp, 0x40
push 2
push str.tc_DDX_H_S
push ebx
push ebp
mov dword [0x10083928], eax
call fcn.10040ccf
push 0x14
push str.tc_DDX_H_G
push ebx
push ebp
mov dword [0x1008392c], eax
call fcn.10040ccf
push 0x14
push str.tc_DDX_T_C
push ebx
push ebp
mov dword [0x10083930], eax
call fcn.10040ccf
push 2
push str.tc_DDX_T_S
push ebx
mov dword [0x10083934], eax
push ebp
call fcn.10040ccf
add esp, 0x40
push 0x14
push str.tc_DDX_U
push ebx
push ebp
mov dword [0x10083938], eax
call fcn.10040ccf
push 1
push str.tc_DDX_I
push ebx
push ebp
mov dword [0x1008393c], eax
call fcn.10040ccf
push 3
push str.tc_DDX_S
push ebx
push ebp
mov dword [0x10083940], eax
call fcn.10040ccf
push 0
push str.tc_W_L
push ebx
push ebp
mov dword [0x10083944], eax
call fcn.10040ccf
add esp, 0x40
push 0
push str.tc_DDOS_KILL
push ebx
push ebp
mov dword [0x101580ec], eax
call fcn.10040ccf
push 0
push str.tc_DDOS_AP
push ebx
push ebp
mov dword [0x10157884], eax
call fcn.10040ccf
push 0
push str.tc_Speed
test eax, eax
setne al
push ebx
push ebp
mov byte [0x10157888], al
call fcn.10040ccf
mov ecx, eax
and ecx, 0x101000
mov dword [0x10153564], ecx
mov ecx, eax
shr ecx, 0x11
and cl, 1
mov byte [0x10152cda], cl
mov ecx, eax
and ecx, 0x21e000
mov dword [0x100784b4], ecx
mov ecx, eax
push 0
mov dword [0x1015bd00], eax
push str.tc_WaterMark
shr ecx, 0x12
shr eax, 0x13
and cl, 1
and al, 1
push ebx
push ebp
mov byte [0x10152cdb], cl
mov byte [0x10154968], al
call fcn.10040ccf
add esp, 0x40
push 0
push str.tc_WM_Height
push ebx
push ebp
mov dword [0x1015bd04], eax
call fcn.10040ccf
push 0
push str.tc_WM_Blend
mov dword [0x101487e8], eax
push ebx
push ebp
call fcn.10040ccf
push 0
push str.tc_India
push edi
push ebp
mov dword [0x101487ec], eax
call fcn.10040ccf
push 0
push str.tc_IndiaSystem
push edi
push ebp
mov dword [0x10185c7c], eax
call fcn.10040ccf
add esp, 0x40
push 0
push str.tc_India_IO32
push edi
push ebp
mov dword [0x10185c80], eax
call fcn.10040ccf
mov dword [0x10185c84], eax
mov eax, dword [0x101487ec]
add esp, 0x10
test eax, eax
jle 0x100127c2
cmp eax, 0xff
jle 0x100127cc
mov dword [0x101487ec], 0x80
push 0
push str.tc_WM_S_FontSize
push ebx
push ebp
call fcn.10040ccf
add esp, 0x10
mov dword [0x101487e0], eax
test eax, eax
jle 0x100127ed
cmp eax, 0x1f4
jle 0x100127f7
mov dword [0x101487e0], 0xc8
push 0
push str.tc_WM_S_FontWeight
push ebx
push ebp
call fcn.10040ccf
add esp, 0x10
cmp eax, 0x64
mov dword [0x1014fda0], eax
jl 0x10012819
cmp eax, 0x384
jle 0x10012823
mov dword [0x1014fda0], 0x2bc
push 0
push str.tc_WM_S_FontColor
push ebx
push ebp
call fcn.10040ccf
push 0x1ff
mov dword [0x100dc0a0], eax
lea eax, [esp + 0x1469]
push 0
push eax
mov byte [esp + 0x1470], 0
call fcn.10045030
add esp, 0x1c
mov edi, 0x200
push edi
lea eax, [esp + 0x1458]
push eax
push 0x6d
push dword [0x102d3d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
push 0x1015bd08
push str.tc_WM_S_FontName
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001289f
lea eax, [esp + 0x1454]
push eax
push 0x1015bd08
call fcn.1000789a
pop ecx
pop ecx
test byte [0x1015bd04], 1
je 0x100128e0
cmp byte [0x1015bd08], 0
jne 0x100128e0
lea eax, [esp + 0x1454]
push eax
push 0x1015bd08
call fcn.1000789a
and dword [0x100dc0a0], 0
pop ecx
pop ecx
mov dword [0x101487e0], 0xa
mov dword [0x1014fda0], 0x2bc
push edi
lea eax, [esp + 0x1458]
push eax
push 0x6e
push dword [0x102d3d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
mov esi, 0x1015c108
push esi
push str.tc_WM_S_String
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10012922
lea eax, [esp + 0x1454]
push eax
push esi
call fcn.1000789a
pop ecx
pop ecx
push 0
push str.tc_DELTOOLBAR
push ebx
push ebp
call fcn.10040ccf
push 0
push str.tc_DetectType
push ebx
push ebp
mov dword [0x1016ef6c], eax
call fcn.10040ccf
push edi
push 0x10156868
push str.TC_TCServer
mov esi, str.SOFTWARETrueCut_tc_INSTALL
push esi
push ebp
mov dword [0x1016ef68], eax
call fcn.100417d5
add esp, 0x34
cmp eax, 0xffffffff
jne 0x1001296e
mov byte [0x10156868], 0
test dword [0x10151864], 0x20000000
mov byte [0x1015162d], 0
je 0x10012988
mov byte [0x1015162d], 1
push edi
push 0x10156a68
push str.TC_PatchServer
push esi
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100129a9
mov byte [0x10156a68], 0
xor esi, esi
inc esi
push esi
push str.tc_COMMIT_POPUP
push ebx
push ebp
call fcn.10040ccf
push esi
push str.tc_COMMIT_LIST
push ebx
push ebp
mov dword [0x10078cbc], eax
call fcn.10040ccf
or dword [0x10078cbc], eax
push esi
push str.tc_COMMIT_LOG_SAVEFILE
push ebx
push ebp
call fcn.10040ccf
or dword [0x10078cbc], eax
push esi
push str.tc_Cut_USB
push ebx
push ebp
call fcn.10040ccf
add esp, 0x40
push esi
push str.tc_PE_IE
push ebx
push ebp
mov byte [0x10157868], al
call fcn.10040ccf
add esp, 0x10
test eax, eax
setne al
test dword [0x1015786c], 0x80000000
mov esi, 0x111111
mov byte [0x10157869], al
push esi
je 0x10012a2c
push str.tc_AutoEngine
jmp 0x10012a31
push str.tc_Engine
push ebx
push ebp
call fcn.10040ccf
add esp, 0x10
mov dword [0x10078cc4], eax
test eax, eax
jne 0x10012a4a
mov dword [0x10078cc4], esi
push 0
push str.tc_fasoo
push str.SOFTWARETrojanCut_tc_Env
push ebp
call fcn.10040ccf
mov dword [0x10152ce0], eax
mov esi, 0xa000
lea eax, [esp + 0x1a64]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a70]
push eax
push str.tc_ExceptIP
push ebx
push ebp
call fcn.100417d5
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x10012a99
mov byte [esp + 0x1a54], 0
push 0x600
push 0x1015eb48
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012af0
lea eax, [esp + 0x1a54]
push 0x1015eb48
push eax
call fcn.100409eb
cmp dword [0x1015668c], 0
pop ecx
pop ecx
je 0x10012ae5
push 0x1015eb48
push str.tc_ExceptIP_:__s
push 0
call fcn.100412e2
add esp, 0xc
push 0x1015eb48
call fcn.100110ff
pop ecx
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_FileExtExp
push ebx
push ebp
call fcn.100417d5
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10012b23
mov byte [esp + 0x1a54], 0
push edi
push 0x10169150
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012b76
lea eax, [esp + 0x1a54]
push 0x10169150
push eax
call fcn.100409eb
cmp dword [0x1015668c], 0
pop ecx
pop ecx
je 0x10012b6b
push 0x10169150
push str.tc_FileExtExp_:__s
push 0
call fcn.100412e2
add esp, 0xc
push 0x10169150
call fcn.10045308
pop ecx
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_FileExtCut
push ebx
push ebp
call fcn.100417d5
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10012ba9
mov byte [esp + 0x1a54], 0
push edi
mov edi, 0x10169350
push edi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012bf1
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.100409eb
cmp dword [0x1015668c], 0
pop ecx
pop ecx
je 0x10012bea
push edi
push str.tc_FileExtCut_:__s
push 0
call fcn.100412e2
add esp, 0xc
push edi
call fcn.10045308
pop ecx
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_ExceptDLLs
push ebx
push ebp
call fcn.100417d5
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10012c24
mov byte [esp + 0x1a54], 0
push 0x1000
mov edi, 0x1015db48
push edi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012c70
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.100409eb
push edi
call fcn.10045308
add esp, 0xc
cmp dword [0x1015668c], 0
je 0x10012c70
push edi
push str.tc_ExceptDLLs_:__s
push 0
call fcn.100412e2
add esp, 0xc
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_ForceCom
push ebx
push ebp
call fcn.100417d5
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10012ca3
mov byte [esp + 0x1a54], 0
push 0x1000
mov esi, 0x1015cb48
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012cef
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.100409eb
push esi
call fcn.10045308
add esp, 0xc
cmp dword [0x1015668c], 0
je 0x10012cef
push esi
push str.tc_ForceCom_:__s
push 0
call fcn.100412e2
add esp, 0xc
lea eax, [esp + 0x1a54]
push 0xa000
push eax
call fcn.10007867
mov edi, 0x800
push edi
push 0xffffffffffffffff
push 0x100d00a0
call fcn.10045030
push edi
push 0xffffffffffffffff
push 0x1011e3c0
call fcn.10045030
push edi
push 0xffffffffffffffff
push 0x1014eb18
call fcn.10045030
push edi
mov esi, 0x10169750
push esi
call fcn.10007867
and dword [0x10169f50], 0
and dword [0x10169f54], 0
push 0xa000
lea eax, [esp + 0x1a8c]
push eax
push str.tc_RansomFileType
push ebx
push ebp
call fcn.100417d5
add esp, 0x48
cmp eax, 0xffffffff
jne 0x10012d70
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
je 0x10012e79
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.100409eb
cmp dword [0x1015668c], 0
pop ecx
pop ecx
je 0x10012da7
push esi
push str.g_tc_RansomFree_Process_:__s
push 0
call fcn.100412e2
add esp, 0xc
push 0x60
push esi
call fcn.10044f10
pop ecx
pop ecx
mov dword [0x10169f50], eax
test eax, eax
je 0x10012dc8
mov byte [eax], 0
mov eax, dword [0x10169f50]
inc eax
mov dword [0x10169f50], eax
push 0x60
push eax
call fcn.10044f10
pop ecx
pop ecx
mov dword [0x10169f54], eax
test eax, eax
je 0x10012de4
mov byte [eax], 0
inc dword [0x10169f54]
push 0x200
push 0x100d00a0
push 0x3a
push esi
call fcn.100407f8
mov eax, dword [0x10169f50]
add esp, 0x10
test eax, eax
je 0x10012e17
push 0x200
push 0x1011e3c0
push 0x3a
push eax
call fcn.100407f8
add esp, 0x10
mov eax, dword [0x10169f54]
xor esi, esi
cmp eax, esi
je 0x10012e37
push 0x200
push 0x1014eb18
push 0x3a
push eax
call fcn.100407f8
add esp, 0x10
cmp dword [0x1015668c], esi
je 0x10012e79
cmp dword [0x100d00a0], 0xffffffff
je 0x10012e79
cmp esi, edi
jge 0x10012e79
push dword [esi + 0x1014eb18]
push dword [esi + 0x1011e3c0]
push dword [esi + 0x100d00a0]
push str.g_RF_AR_Process__s__g_RF_AR_Ext__s__g_RF_AR_Folder__s_
push 0
call fcn.100412e2
add esi, 4
add esp, 0x14
cmp dword [esi + 0x100d00a0], 0xffffffff
jne 0x10012e48
mov esi, 0xa000
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
cmp byte [0x1015162d], 0
pop ecx
pop ecx
mov edi, str.tc_ExceptProcessForm
mov eax, str.tc_ExceptProcessEnable
jne 0x10012ea3
mov eax, edi
push esi
lea ecx, [esp + 0x1a58]
push ecx
push eax
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10012ec4
mov byte [esp + 0x1a54], 0
cmp dword [0x1015668c], 0
je 0x10012ef5
cmp byte [0x1015162d], 0
mov eax, str.tc_ExceptProcessEnable
jne 0x10012edd
mov eax, edi
lea ecx, [esp + 0x1a54]
push ecx
push eax
push str.__s_sPath__s_
push 0
call fcn.100412e2
add esp, 0x10
mov esi, 0x1000
push esi
push 0xffffffffffffffff
push 0x101471e0
call fcn.10045030
push esi
push 0xffffffffffffffff
push 0x100ba8a0
call fcn.10045030
push esi
push 0xffffffffffffffff
push 0x1011ebc0
call fcn.10045030
mov esi, 0x5000
push esi
mov edi, 0x1015f148
push edi
call fcn.10007867
push esi
push 0x10164148
call fcn.10007867
xor eax, eax
push 0x3ff
push eax
mov dword [0x1016914c], eax
mov dword [0x10169148], eax
mov byte [esp + 0x1690], al
lea eax, [esp + 0x1691]
push eax
call fcn.10045030
add esp, 0x40
push 0x400
mov esi, 0x10154168
push esi
call fcn.10007867
push 0x200
push 0x10154568
call fcn.10007867
push 0x200
push 0x10154768
call fcn.10007867
push 0x400
push esi
push 0x100647d4
push 0x10155228
call fcn.1000f7e2
add esp, 0x28
test eax, eax
je 0x10012fc6
push esi
lea eax, [esp + 0x1658]
push str.:_s:
push eax
call fcn.10045378
add esp, 0xc
push 0x200
push 0x10154568
push 0x100647b8
push 0x10155228
call fcn.1000f7e2
push 0x200
push 0x10154768
push 0x100647a8
push 0x10155228
call fcn.1000f7e2
push esi
call fcn.10045308
push 0x10154568
call fcn.10045308
push 0x10154768
call fcn.10045308
lea eax, [esp + 0x1680]
push eax
call fcn.10045308
add esp, 0x30
cmp dword [0x1015668c], 0
je 0x10013045
push 0x10154768
push 0x10154568
push esi
push str.g_sFileDescription__s__g_sOriginalFilename__s__g_sLegalCopyright__s_
push 0
call fcn.100412e2
add esp, 0x14
cmp byte [esp + 0x1a54], 0
je 0x100136b2
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.100409eb
push edi
call fcn.10045308
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x1015f148]
mov byte [eax + 0x10164148], cl
inc eax
test cl, cl
jne 0x1001306c
cmp dword [0x1015668c], 0
je 0x10013096
push edi
push str.g_tc_ExceptProcess_:__s
push 0
call fcn.100412e2
add esp, 0xc
push 0x60
push edi
call fcn.10044f10
pop ecx
pop ecx
mov dword [0x10169148], eax
test eax, eax
je 0x100130ec
mov byte [eax], 0
inc dword [0x10169148]
push 0x60
push dword [0x10169148]
call fcn.10044f10
pop ecx
pop ecx
mov ecx, 0x10164148
mov dword [0x1016914c], eax
mov esi, eax
sub ecx, eax
mov dl, byte [esi]
mov byte [esi + ecx], dl
inc esi
test dl, dl
jne 0x100130cf
mov esi, 0x200
test eax, eax
je 0x100130f1
mov byte [eax], dl
inc dword [0x1016914c]
jmp 0x100130f1
mov esi, 0x200
cmp byte [0x1015162d], 0
push esi
push 0x101471e0
je 0x10013138
push 0x3e
push edi
call fcn.100407f8
mov eax, dword [0x10169148]
add esp, 0x10
test eax, eax
je 0x10013125
push esi
push 0x100ba8a0
push 0x3e
push eax
call fcn.100407f8
add esp, 0x10
mov eax, dword [0x1016914c]
test eax, eax
je 0x10013177
push esi
push 0x1011ebc0
push 0x3e
jmp 0x1001316e
push 0x3a
push edi
call fcn.100407f8
mov eax, dword [0x10169148]
add esp, 0x10
test eax, eax
je 0x1001315d
push esi
push 0x100ba8a0
push 0x3a
push eax
call fcn.100407f8
add esp, 0x10
mov eax, dword [0x1016914c]
test eax, eax
je 0x10013177
push esi
push 0x1011ebc0
push 0x3a
push eax
call fcn.100407f8
add esp, 0x10
xor esi, esi
cmp dword [0x1015668c], esi
je 0x100131e1
cmp dword [0x101471e0], 0xffffffff
je 0x100131e1
mov edi, 0x10060ec9
cmp esi, 0x400
jge 0x100131e1
mov eax, dword [esi*4 + 0x1011ebc0]
cmp eax, 0xffffffff
jne 0x100131a5
mov eax, edi
mov ecx, dword [esi*4 + 0x100ba8a0]
mov edx, ecx
cmp ecx, 0xffffffff
jne 0x100131b5
mov edx, edi
mov ecx, dword [esi*4 + 0x101471e0]
cmp ecx, 0xffffffff
jne 0x100131c3
mov ecx, edi
push eax
push edx
push ecx
push esi
push str.Except_Log__d__g_tc_AR_EXProcess__s__g_tc_AR_EXProcessIP__s__g_tc_AR_EXFolder__s_
push 0
call fcn.100412e2
add esp, 0x18
inc esi
cmp dword [esi*4 + 0x101471e0], 0xffffffff
jne 0x1001318f
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add dword [esp + 0x1c], 0x9534e000
lea eax, [esp + 0x2c]
push eax
adc dword [esp + 0x24], 0x64
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x34]
push eax
lea eax, [esp + 0xef8]
push str._04d__02d__02d
push eax
call fcn.10045378
and dword [esp + 0x28], 0
add esp, 0x14
cmp dword [0x101471e0], 0xffffffff
je 0x100136b2
mov esi, dword [esp + 0x14]
cmp esi, 0x400
jge 0x100136b2
mov edi, esi
shl edi, 2
mov eax, dword [edi + 0x101471e0]
cmp byte [eax], 0
je 0x10013320
push eax
push 0x10155628
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10013320
mov eax, dword [edi + 0x1011ebc0]
cmp eax, 0xffffffff
je 0x100132b0
test eax, eax
je 0x100132b0
cmp byte [eax], 0
je 0x100132b0
push eax
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10013320
mov eax, dword [edi + 0x100ba8a0]
cmp eax, 0xffffffff
je 0x10013308
cmp byte [eax], 0
je 0x10013308
push 0x2d
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
je 0x10013308
mov esi, dword [edi + 0x100ba8a0]
lea eax, [esp + 0xeec]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100132f9
test cl, cl
je 0x100132f5
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100132f9
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x100132db
xor eax, eax
jmp 0x100132fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001147a
jmp 0x10013320
mov eax, dword [edi + 0x100ba8a0]
cmp eax, 0xffffffff
je 0x10013b16
cmp byte [eax], 0
je 0x10013b16
mov eax, dword [edi + 0x101471e0]
cmp byte [eax], 0x2a
jne 0x10013408
cmp byte [eax + 1], 0
jne 0x10013408
mov eax, dword [edi + 0x1011ebc0]
cmp eax, 0xffffffff
je 0x10013408
cmp byte [eax], 0
je 0x10013408
push eax
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10013408
mov eax, dword [edi + 0x100ba8a0]
cmp eax, 0xffffffff
je 0x100133f0
cmp byte [eax], 0
je 0x100133f0
push 0x2d
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
je 0x100133f0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
lea eax, [esp + 0x894]
push str._04d__02d__02d
push eax
call fcn.10045378
mov esi, dword [edi + 0x100ba8a0]
add esp, 0x14
lea eax, [esp + 0x888]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100133e1
test cl, cl
je 0x100133dd
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100133e1
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x100133c3
xor eax, eax
jmp 0x100133e6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001147a
jmp 0x10013408
mov eax, dword [edi + 0x100ba8a0]
cmp eax, 0xffffffff
je 0x10013b3e
cmp byte [eax], 0
je 0x10013b3e
mov eax, dword [edi + 0x101471e0]
cmp byte [eax], 0x2b
jne 0x100134e6
cmp byte [eax + 1], 0
jne 0x100134e6
mov eax, dword [edi + 0x1011ebc0]
cmp eax, 0xffffffff
je 0x100134e6
cmp byte [eax], 0
je 0x100134e6
push eax
mov esi, 0x10154168
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100134e6
mov eax, dword [edi + 0x100ba8a0]
cmp eax, 0xffffffff
je 0x10013b5d
cmp byte [eax], 0
je 0x10013b5d
push 0x2d
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
je 0x10013b5d
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x7e]
push eax
movzx eax, word [esp + 0x7e]
push eax
movzx eax, word [esp + 0x80]
push eax
lea eax, [esp + 0x894]
push str._04d__02d__02d
push eax
call fcn.10045378
mov esi, dword [edi + 0x100ba8a0]
add esp, 0x14
lea eax, [esp + 0x888]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100134d9
test cl, cl
je 0x100134d5
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100134d9
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x100134bb
xor eax, eax
jmp 0x100134de
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001147a
mov eax, dword [edi + 0x101471e0]
cmp byte [eax], 0x2d
jne 0x100135c1
cmp byte [eax + 1], 0
jne 0x100135c1
mov eax, dword [edi + 0x1011ebc0]
cmp eax, 0xffffffff
je 0x100135c1
cmp byte [eax], 0
je 0x100135c1
push eax
mov esi, 0x10154568
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100135c1
mov eax, dword [edi + 0x100ba8a0]
cmp eax, 0xffffffff
je 0x10013b78
cmp byte [eax], 0
je 0x10013b78
push 0x2d
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
je 0x10013b78
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
lea eax, [esp + 0x894]
push str._04d__02d__02d
push eax
call fcn.10045378
mov esi, dword [edi + 0x100ba8a0]
add esp, 0x14
lea eax, [esp + 0x888]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100135b4
test cl, cl
je 0x100135b0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100135b4
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x10013596
xor eax, eax
jmp 0x100135b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001147a
mov eax, dword [edi + 0x101471e0]
cmp byte [eax], 0x63
jne 0x1001369c
cmp byte [eax + 1], 0
jne 0x1001369c
mov eax, dword [edi + 0x1011ebc0]
cmp eax, 0xffffffff
je 0x1001369c
cmp byte [eax], 0
je 0x1001369c
push eax
mov esi, 0x10154768
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1001369c
mov eax, dword [edi + 0x100ba8a0]
cmp eax, 0xffffffff
je 0x10013b93
cmp byte [eax], 0
je 0x10013b93
push 0x2d
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
je 0x10013b93
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x48]
push eax
lea eax, [esp + 0x894]
push str._04d__02d__02d
push eax
call fcn.10045378
mov edi, dword [edi + 0x100ba8a0]
add esp, 0x14
lea eax, [esp + 0x888]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x1001368f
test cl, cl
je 0x1001368b
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x1001368f
inc eax
inc eax
inc edi
inc edi
test cl, cl
jne 0x10013671
xor eax, eax
jmp 0x10013694
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001147a
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp dword [eax*4 + 0x101471e0], 0xffffffff
jne 0x10013252
mov esi, 0xa000
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_WhiteList
push ebx
push ebp
call fcn.100417d5
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x100136ea
mov byte [esp + 0x1a54], 0
mov esi, 0x800
push esi
or edi, 0xffffffff
push edi
push 0x101133a8
call fcn.10045030
push esi
push edi
push 0x10148c18
call fcn.10045030
push esi
push edi
push 0x10149618
call fcn.10045030
push esi
push edi
push 0x1014e118
call fcn.10045030
push esi
push edi
push 0x101461d0
call fcn.10045030
xor eax, eax
push 0x5000
mov edi, 0x10169f58
push edi
mov dword [0x1016ef5c], eax
mov dword [0x1016ef60], eax
mov dword [0x1016ef64], eax
call fcn.10007867
add esp, 0x44
cmp byte [esp + 0x1a54], 0
je 0x1001389a
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.100409eb
cmp dword [0x1015668c], 0
pop ecx
pop ecx
je 0x10013789
push edi
push str.g_tc_WhiteList_:__s
push 0
call fcn.100412e2
add esp, 0xc
push 0x60
push edi
call fcn.10044f10
pop ecx
pop ecx
mov dword [0x1016ef5c], eax
test eax, eax
je 0x100137aa
mov byte [eax], 0
mov eax, dword [0x1016ef5c]
inc eax
mov dword [0x1016ef5c], eax
push 0x60
push eax
call fcn.10044f10
pop ecx
pop ecx
mov dword [0x1016ef60], eax
test eax, eax
je 0x100137cb
mov byte [eax], 0
mov eax, dword [0x1016ef60]
inc eax
mov dword [0x1016ef60], eax
push 0x60
push eax
call fcn.10044f10
pop ecx
pop ecx
mov dword [0x1016ef64], eax
test eax, eax
je 0x100137e7
mov byte [eax], 0
inc dword [0x1016ef64]
push 0x200
push 0x10148c18
push 0x3a
push edi
call fcn.100407f8
mov eax, dword [0x1016ef5c]
add esp, 0x10
mov edi, 0x200
test eax, eax
je 0x1001381b
push edi
push 0x10149618
push 0x3a
push eax
call fcn.100407f8
add esp, 0x10
mov eax, dword [0x1016ef60]
test eax, eax
je 0x10013835
push edi
push 0x1014e118
push 0x3a
push eax
call fcn.100407f8
add esp, 0x10
mov eax, dword [0x1016ef64]
test eax, eax
je 0x1001384f
push edi
push 0x101461d0
push 0x3a
push eax
call fcn.100407f8
add esp, 0x10
cmp dword [0x1015668c], 0
je 0x1001389a
cmp dword [0x10148c18], 0xffffffff
je 0x1001389a
xor edi, edi
cmp edi, esi
jge 0x1001389a
push dword [edi + 0x101461d0]
push dword [edi + 0x1014e118]
push dword [edi + 0x10149618]
push dword [edi + 0x10148c18]
push str.g_WL_arName__s__g_WL_arHash__s__g_WL_arSign__s__g_WL_arFolder__s_
push 0
call fcn.100412e2
add edi, 4
add esp, 0x18
cmp dword [edi + 0x10148c18], 0xffffffff
jne 0x10013863
push esi
push 0xffffffffffffffff
push 0x10148c18
call fcn.10045030
push 0x200
push 0x10149418
call fcn.10007867
mov edi, 0xa000
lea eax, [esp + 0x1a68]
push edi
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a74]
push eax
push str.tc_SvrAgentDetectFolder
push ebx
push ebp
call fcn.100417d5
add esp, 0x30
cmp eax, 0xffffffff
jne 0x100138ee
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
je 0x10013923
lea eax, [esp + 0x1a54]
push 0x10149418
push eax
call fcn.100409eb
push 0x200
push 0x100e01a8
push 0x3a
push 0x10149418
call fcn.100407f8
add esp, 0x18
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a60]
push eax
push str.tc_ExceptURL_SRC
push ebx
push ebp
call fcn.100417d5
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10013956
mov byte [esp + 0x1a54], 0
push esi
mov esi, 0x1016ef70
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x100139c5
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.100409eb
cmp dword [0x1015668c], 0
pop ecx
pop ecx
je 0x10013997
push esi
push str.g_tc_ExceptURL_:__s
push 0
call fcn.100412e2
add esp, 0xc
push esi
mov esi, 0x1015eb48
push esi
push str._s:_s
push esi
call fcn.10045378
add esp, 0x10
cmp dword [0x1015668c], 0
je 0x100139c5
push esi
push str.All_ExceptIP_____s
push 0
call fcn.100412e2
add esp, 0xc
push 0x600
mov esi, 0x1016f770
push esi
call fcn.10007867
lea eax, [esp + 0x1a5c]
push edi
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a68]
push eax
push str.tc_CutExceptIP
push ebx
push ebp
call fcn.100417d5
add esp, 0x24
cmp eax, 0xffffffff
jne 0x10013a08
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
je 0x10013a49
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.100409eb
push esi
call fcn.10045308
add esp, 0xc
cmp dword [0x1015668c], 0
je 0x10013a42
push esi
push str.g_tc_CutExceptIP_:__s
push 0
call fcn.100412e2
add esp, 0xc
push esi
call fcn.100110ff
pop ecx
cmp dword [0x1015668c], 0
je 0x10013a69
movzx eax, byte [0x10078497]
push eax
push str.g_bRansomGoGo_1__d_
push 0
call fcn.100412e2
add esp, 0xc
and dword [esp + 0x18], 0
push 1
lea eax, [esp + 0x1c]
push eax
push 0xa1
push str.backupagent
push 4
push 0x10154e28
call fcn.100444e9
mov esi, eax
add esp, 0x18
mov edi, esi
test esi, esi
jne 0x10013a9b
mov edi, str.backupagent
cmp byte [edi], 0
je 0x10013ab6
test esi, esi
je 0x10013bae
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
jbe 0x10013bba
test esi, esi
je 0x10013ac1
push esi
call fcn.10046e73
pop ecx
push 2
lea eax, [esp + 0x1c]
push eax
push 0x9d
mov esi, str.facebookupdate.exe
push esi
push 5
push 0x10154e28
call fcn.100444e9
add esp, 0x18
mov dword [esp + 0x14], eax
mov edi, eax
test eax, eax
jne 0x10013aee
mov edi, esi
cmp byte [edi], 0
je 0x10013c9c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10013bfd
mov ecx, dword [esp + 0x18]
add ecx, eax
cmp edi, ecx
ja 0x10013c9c
jmp 0x10013c09
push dword [esi*4 + 0x1011ebc0]
push dword [esi*4 + 0x101471e0]
push 0x10155228
push esi
push str.Except_process__d__g_szMyExeFullPath__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
push 0
call fcn.100412e2
add esp, 0x18
jmp 0x1001147a
mov eax, dword [esp + 0x14]
push dword [eax*4 + 0x1011ebc0]
push dword [eax*4 + 0x101471e0]
push 0x10155228
push eax
push str.Except_folder__d__g_szMyExeFullPath__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
jmp 0x10013b2f
mov eax, dword [esp + 0x14]
push dword [eax*4 + 0x1011ebc0]
push dword [eax*4 + 0x101471e0]
push esi
push eax
push str.Except_FileDescription__d__g_sFileDescription__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
jmp 0x10013b2f
mov eax, dword [esp + 0x14]
push dword [eax*4 + 0x1011ebc0]
push dword [eax*4 + 0x101471e0]
push esi
push eax
push str.Except_OriginalFilename__d__g_sOriginalFilename__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
jmp 0x10013b2f
mov eax, dword [esp + 0x14]
push dword [eax*4 + 0x1011ebc0]
push dword [eax*4 + 0x101471e0]
push esi
push eax
push str.Except_Copyright__d__g_sLegalCopyright__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
jmp 0x10013b2f
cmp edi, 0x100645d9
ja 0x10013ac1
push edi
push 0x10154168
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10013bea
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013bd0
sub eax, ecx
lea edi, [edi + eax + 1]
test edi, edi
jne 0x10013a9b
jmp 0x10013ab6
test esi, esi
je 0x1001147a
push esi
call fcn.10046e73
jmp 0x10011521
cmp edi, 0x10064535
ja 0x10013cad
push edi
push 0x10154568
mov byte [esp + 0x1b], 0
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10013c24
mov byte [esp + 0x13], 1
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013c29
sub eax, esi
lea edi, [edi + eax + 1]
test edi, edi
je 0x10013c9c
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013c3f
sub eax, edx
je 0x10013c9c
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10013c5e
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013c9c
jmp 0x10013c66
cmp edi, 0x10064535
ja 0x10013cad
cmp byte [esp + 0x13], 0
je 0x10013c82
push edi
push 0x10154768
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10013bea
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013c87
sub eax, esi
lea edi, [edi + eax + 1]
test edi, edi
jne 0x10013aee
cmp dword [esp + 0x14], 0
je 0x10013cad
push dword [esp + 0x14]
call fcn.10046e73
pop ecx
push 1
lea eax, [esp + 0x1c]
push eax
push 0x9c
push 0x10064230
push 6
push 0x10154e28
call fcn.100444e9
mov esi, eax
add esp, 0x18
mov edi, esi
test esi, esi
jne 0x10013cda
mov edi, 0x10064230
cmp byte [edi], 0
je 0x10013d27
test esi, esi
je 0x10013cef
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013d27
jmp 0x10013cf7
cmp edi, 0x100642cc
ja 0x10013d32
push edi
push 0x10154168
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10013d20
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013d0d
sub eax, ecx
lea edi, [edi + eax + 1]
test edi, edi
jne 0x10013cda
jmp 0x10013d27
mov byte [0x10078497], 0
test esi, esi
je 0x10013d32
push esi
call fcn.10046e73
pop ecx
push 1
lea eax, [esp + 0x1c]
push eax
push 3
push 0x1006422c
push 7
push 0x10154e28
call fcn.100444e9
mov esi, eax
add esp, 0x18
mov edi, esi
test esi, esi
jne 0x10013da2
mov edi, 0x1006422c
jmp 0x10013da2
test edi, edi
je 0x10013db4
cmp byte [edi], 0
je 0x10013db4
test esi, esi
je 0x10013d77
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013db4
jmp 0x10013d7f
cmp edi, 0x1006422f
ja 0x10013dbf
push edi
push 0x10154768
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10013dad
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013d95
sub eax, ecx
lea edi, [edi + eax + 1]
cmp byte [0x10078497], 0
jne 0x10013d5e
jmp 0x10013db4
mov byte [0x10078497], 0
test esi, esi
je 0x10013dbf
push esi
call fcn.10046e73
pop ecx
push 2
lea eax, [esp + 0x1c]
push eax
push 3
push 0x1006422c
push 8
push 0x10154e28
call fcn.100444e9
mov esi, eax
add esp, 0x18
mov edi, esi
test esi, esi
jne 0x10013ea6
mov edi, 0x1006422c
jmp 0x10013ea6
test edi, edi
je 0x10013ebc
cmp byte [edi], 0
je 0x10013ebc
test esi, esi
je 0x10013e17
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013ebc
jmp 0x10013e23
cmp edi, 0x1006422f
ja 0x10013ec7
push edi
push 0x10154568
mov byte [esp + 0x1b], 0
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10013e3e
mov byte [esp + 0x13], 1
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013e43
sub eax, ecx
lea edi, [edi + eax + 1]
test edi, edi
je 0x10013ebc
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013e59
sub eax, edx
je 0x10013ebc
test esi, esi
je 0x10013e74
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013ebc
jmp 0x10013e7c
cmp edi, 0x1006422f
ja 0x10013ec7
cmp byte [esp + 0x13], 0
je 0x10013e94
push edi
push 0x10154768
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10013eb5
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013e99
sub eax, ecx
lea edi, [edi + eax + 1]
cmp byte [0x10078497], 0
jne 0x10013df2
jmp 0x10013ebc
mov byte [0x10078497], 0
test esi, esi
je 0x10013ec7
push esi
call fcn.10046e73
pop ecx
test dword [0x1015186c], 0x400
je 0x10013fb7
mov edi, str.process_hacker
cmp byte [edi], 0
je 0x10013fb7
cmp edi, 0x1006422c
jae 0x10013fb7
push edi
mov esi, 0x10154168
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10013f9d
call fcn.10031078
or byte [0x102d3d93], al
push 0x3ff
lea eax, [esp + 0x8f1]
push 0
push eax
mov byte [esp + 0x8f8], 0
call fcn.10045030
push esi
lea eax, [esp + 0x8fc]
push str.Behavior_Blocking____Hacking_Tool__s
push eax
call fcn.10045378
lea eax, [esp + 0x904]
push 0x7c
push eax
call fcn.10044f10
xor esi, esi
add esp, 0x20
cmp eax, esi
je 0x10013f5c
mov byte [eax], 0x60
lea eax, [esp + 0x8ec]
push 0x7c
push eax
call fcn.10044f10
pop ecx
pop ecx
cmp eax, esi
je 0x10013f74
mov byte [eax], 0x60
push esi
push esi
push esi
lea eax, [esp + 0x8f8]
push eax
push 1
push bind
push 0x100
mov ecx, 0x101adac0
call fcn.1003921b
test eax, eax
jne 0x100141b2
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013fa2
sub eax, esi
lea edi, [edi + eax + 1]
test edi, edi
jne 0x10013edc
cmp dword [0x1015668c], 0
je 0x10013ffe
push 0x10154168
push 0x10155228
push str.MyGetFileVersionInformation___s__s_
xor esi, esi
push esi
call fcn.100412e2
push dword [0x10078cd8]
push str.g_isOS__08x_
push esi
call fcn.100412e2
movzx eax, byte [0x10078497]
push eax
push str.g_bRansomGoGo_2__d_
push esi
call fcn.100412e2
add esp, 0x28
mov edi, 0x1400
push edi
mov esi, 0x10182e48
push esi
call fcn.10007867
push edi
mov edi, 0x10184248
push edi
call fcn.10007867
add esp, 0x10
call fcn.1000e5a4
cmp dword [0x1015668c], 0
je 0x1001403d
push edi
push esi
push str.Get_tc_BlackList_from_BlackFile_:___s__s_
push 0
call fcn.100412e2
add esp, 0x10
mov edi, 0xa000
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10007867
lea eax, [esp + 0x10a5c]
push 0x5000
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a68]
push eax
push str.tc_BlackList
push ebx
push ebp
call fcn.100417d5
add esp, 0x24
cmp eax, 0xffffffff
jne 0x10014087
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
mov edi, 0x100da8a0
je 0x1001425e
lea eax, [esp + 0x10a54]
push eax
lea eax, [esp + 0x1a58]
push eax
call fcn.100409eb
cmp dword [0x1015668c], 0
pop ecx
pop ecx
je 0x100140d1
lea eax, [esp + 0x10a54]
push eax
push str.Get_tc_BlackList_from_regedit_:___s_
push 0
call fcn.100412e2
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x10a54]
mov byte [esp + eax + 0x1a54], cl
inc eax
test cl, cl
jne 0x100140d3
lea eax, [esp + 0x1a54]
push 0x60
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x100141bc
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10014100
mov edi, esi
mov esi, 0x10063758
lea eax, [esp + 0x1a54]
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001411a
mov edi, 0x10182e48
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014129
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x1000
mov ecx, eax
and ecx, 3
push 0xffffffffffffffff
push 0x100da8a0
rep movsb byte es:[edi], byte [esi]
call fcn.10045030
push 0x200
push 0x100da8a0
lea eax, [esp + 0x1a68]
push 0x3a
push eax
call fcn.100407f8
add esp, 0x1c
xor eax, eax
cmp dword [0x100da8a0], 0xffffffff
je 0x1001418d
mov ecx, 0x100da8a0
cmp ecx, 0x100db0a0
jge 0x1001418d
add ecx, 4
inc eax
cmp dword [ecx], 0xffffffff
jne 0x1001417c
test eax, eax
jle 0x1001425e
mov edi, 0x10184248
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001419b
dec eax
mov esi, 0x10063758
movsw word es:[edi], word [esi]
jne 0x10014195
jmp 0x1001425e
call fcn.1002ca33
jmp 0x1001147a
push 0x1000
push 0xffffffffffffffff
push edi
call fcn.10045030
push 0x200
push edi
lea eax, [esp + 0x1a68]
push 0x60
push eax
call fcn.100407f8
mov edi, esi
add esp, 0x1c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100141e4
mov eax, dword [0x100da8a0]
mov edx, 0x10063758
mov esi, edx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100141fc
mov edi, 0x10182e48
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001420b
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x10184248
mov edi, ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10014229
mov eax, dword [0x100da8a4]
mov esi, edx
movsw word es:[edi], word [esi]
mov esi, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001423c
mov edi, ecx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014248
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x10182e48
push esi
call fcn.10045308
mov edi, 0x10184248
push edi
call fcn.10045308
cmp dword [0x1015668c], 0
pop ecx
pop ecx
je 0x10014290
push edi
push esi
push str.g_tc_BlackList:___s_g_tc_BlackListVer:___s_
push 0
call fcn.100412e2
add esp, 0x10
cmp byte [0x10182e48], 0
jne 0x100142ff
push esi
push 0x10064c88
push esi
call fcn.10045378
push edi
push 0x10064c88
push edi
call fcn.10045378
add esp, 0x18
cmp byte [0x10182e48], 0
jne 0x100142ff
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100142c2
sub eax, edx
cmp byte [eax + 0x10182e47], 0x3a
je 0x100142ff
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x100142d5
mov edi, esi
mov eax, 0x10063758
mov esi, eax
movsw word es:[edi], word [esi]
mov edi, 0x10184248
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100142ee
mov esi, eax
movsw word es:[edi], word [esi]
mov esi, 0x10182e48
test byte [0x1016ef6c], 4
je 0x1001483e
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014311
sub eax, edx
cmp eax, 2
jbe 0x1001483e
push str..dll
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100144b7
cmp dword [0x10154984], 0
jne 0x1001438c
push str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10014363
push str.EnumProcessModules
push eax
call edi
mov dword [0x10154984], eax
cmp dword [0x10154984], 0
jne 0x1001438c
push str.EnumProcessModules
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov dword [0x10154984], eax
test eax, eax
je 0x100144b7
push 0x800
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.10045030
mov edi, 0x1ff
push edi
lea eax, [esp + 0x8fd]
push 0
push eax
mov byte [esp + 0x904], 0
call fcn.10045030
push edi
xor edi, edi
lea eax, [esp + 0xf6d]
push edi
push eax
mov byte [esp + 0xf74], 0
call fcn.10045030
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x1c]
push ecx
push 0x800
lea ecx, [esp + 0x90]
push ecx
push eax
mov dword [esp + 0x34], eax
call dword [0x10154984]
cmp eax, edi
je 0x100144ad
mov eax, dword [esp + 0x1c]
shr eax, 2
cmp edi, eax
jae 0x100144ad
push 0x200
lea eax, [esp + 0x8f0]
push eax
push dword [esp + edi*4 + 0x90]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xf50]
push eax
lea eax, [esp + 0x8f0]
push eax
call fcn.100403ef
lea eax, [esp + 0xf58]
push eax
call fcn.10045308
lea eax, [esp + 0xf5c]
push str..dll
push eax
call fcn.10045450
add esp, 0x14
test eax, eax
je 0x10014486
cmp byte [esp + 0xf50], 0
je 0x10014486
lea eax, [esp + 0xf50]
push eax
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1001448c
inc edi
jmp 0x10014404
cmp dword [0x1015668c], 0
je 0x100144ad
push esi
lea eax, [esp + 0xf54]
push eax
push str.g_tc_BlackList_Found_Module___s__in_Apps__s_
push 0
call fcn.100412e2
add esp, 0x10
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10154168], 0
je 0x100144e8
lea eax, [esp + 0x1654]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100144ca
sub eax, edx
cmp eax, 3
jbe 0x100144e8
lea eax, [esp + 0x1654]
push eax
push esi
call fcn.10045450
pop ecx
pop ecx
push 0x1000
push 0xffffffffffffffff
mov edi, 0x100da8a0
push edi
call fcn.10045030
add esp, 0xc
cmp byte [0x10182e48], 0
je 0x10014517
push 0x200
push edi
push 0x3a
push esi
call fcn.100407f8
add esp, 0x10
push 0x1000
push 0xffffffffffffffff
mov esi, 0x101451d0
push esi
call fcn.10045030
add esp, 0xc
cmp byte [0x10184248], 0
mov edi, 0x200
je 0x1001454b
push edi
push esi
push 0x3a
push 0x10184248
call fcn.100407f8
add esp, 0x10
xor esi, esi
cmp dword [0x1015668c], esi
je 0x100145b5
cmp dword [0x100da8a0], 0xffffffff
je 0x10014584
cmp esi, edi
jge 0x10014584
push dword [esi*4 + 0x100da8a0]
push esi
push str.m_sBlackList_member__d___s_
push 0
call fcn.100412e2
add esp, 0x10
inc esi
cmp dword [esi*4 + 0x100da8a0], 0xffffffff
jne 0x1001455e
xor esi, esi
cmp dword [0x101451d0], 0xffffffff
je 0x100145b5
cmp esi, edi
jge 0x100145b5
push dword [esi*4 + 0x101451d0]
push esi
push str.m_sBlackListVer_member__d___s_
push 0
call fcn.100412e2
add esp, 0x10
inc esi
cmp dword [esi*4 + 0x101451d0], 0xffffffff
jne 0x1001458f
push 0x104
lea eax, [esp + 0xcf0]
push 0
push eax
call fcn.10045030
add esp, 0xc
xor eax, eax
mov byte [esp + 0x1654], 0
mov dl, 1
or esi, 0xffffffff
mov ecx, dword [eax + 0x100da8a0]
cmp ecx, esi
jne 0x100145f1
cmp dword [eax + 0x101451d0], esi
je 0x10014605
cmp ecx, esi
je 0x100145f9
cmp dword [eax + 0x101451d0], esi
jne 0x100145fb
xor dl, dl
add eax, 4
cmp eax, 0x800
jl 0x100145db
xor edi, edi
test dl, dl
je 0x1001483e
mov esi, edi
shl esi, 2
mov eax, dword [esi + 0x100da8a0]
cmp eax, 0xffffffff
je 0x1001483e
cmp edi, 0x200
jge 0x1001483e
cmp dword [0x1015668c], 0
mov byte [esp + 0xcec], 0
je 0x10014656
push 0x400
push 0x10185650
push str.tc_Proc_OK
push ebx
push ebp
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10014863
mov byte [0x10185650], 0
push 1
push str.tc_CUT_LOG_SEND_SERVER
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push ebp
call fcn.10040ccf
push 0xa000
mov dword [0x10078cc8], eax
lea eax, [esp + 0x1a68]
push eax
push str.tc_USBExpList
push ebx
push ebp
call fcn.100417d5
add esp, 0x24
cmp eax, 0xffffffff
jne 0x100148a3
mov byte [esp + 0x1a54], 0
push 0x1000
mov esi, 0x10181e48
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x100148ea
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.100409eb
xor edi, edi
pop ecx
pop ecx
cmp dword [0x1015668c], edi
je 0x100148ec
push esi
push str.g_tc_USBExpList___s_
push edi
call fcn.100412e2
add esp, 0xc
jmp 0x100148ec
xor edi, edi
cmp byte [0x10157889], 0
je 0x10014914
push str._tc_Per_is_Personal_setting_on_public_
push edi
mov dword [0x10157890], edi
mov dword [0x1015787c], edi
mov dword [0x10157878], edi
call fcn.100412e2
pop ecx
pop ecx
cmp dword [0x10152cdc], 0x10000
mov byte [0x10078cb8], 0
jae 0x10014942
cmp dword [0x101580b8], edi
jne 0x10014942
push 0x1b
push 0x102e1000
call fcn.10007867
pop ecx
pop ecx
call sym.TC_AD.DLL_FDrv
call fcn.1002d5cb
push 0x10155428
call fcn.1002ff15
pop ecx
mov byte [0x10151897], al
test al, al
je 0x10014962
mov byte [0x10078497], 0
test dword [0x10157880], 0x80000000
jne 0x10014c57
test dword [0x1015786c], 0x1000000
mov edi, 0x10063d68
mov ebp, 0x10152ad8
je 0x100149a0
cmp byte [0x10078497], 0
je 0x100149a0
test al, al
je 0x10014ce4
mov byte [0x10078497], 0
mov ebx, 0x3ff
mov esi, 0x10060ec9
test dword [0x10078cd0], 0x80000
je 0x10014b5c
test dword [0x10157880], 0x80000000
jne 0x10014b5c
cmp byte [0x10078497], 0
je 0x10014c57
push 0x10156e68
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10014b5c
cmp dword [0x10152cdc], 0x10000
jae 0x10014b5c
cmp byte [0x1015788a], al
jne 0x10014b5c
cmp byte [0x10078497], 0
je 0x10014c57
cmp dword [0x10152cdc], 0x10000
jae 0x10014c57
test dword [0x10151864], 0x2000000
je 0x10014c57
cmp byte [0x10152ad8], 0
jne 0x10014c23
push ebx
lea eax, [esp + 0xf55]
push 0
push eax
mov byte [esp + 0xf5c], 0
call fcn.10045030
push ebx
lea eax, [esp + 0x8fd]
push 0
push eax
mov byte [esp + 0x904], 0
call fcn.10045030
push esi
push 0x100627f4
lea eax, [esp + 0x90c]
push eax
push 0x10155228
call fcn.10040259
push esi
push 0x10063a50
lea eax, [esp + 0xf80]
push eax
lea eax, [esp + 0x920]
push eax
call fcn.10040259
push esi
push edi
lea eax, [esp + 0x92c]
push eax
lea eax, [esp + 0xf94]
push eax
call fcn.10040259
add esp, 0x48
lea eax, [esp + 0x8ec]
push ebp
push eax
call fcn.1002ce47
pop ecx
pop ecx
push ebp
push str.g_szSign_:__s
push 0
call fcn.100412e2
add esp, 0xc
cmp byte [0x10152ad8], 0
je 0x10014c57
test dword [0x1015786c], 0x4000000
mov byte [0x1015162c], 0
je 0x10014c8f
push 0x10155628
push str.explorer.exeiexplore.exechrome.exewhale.exeswing.exeoutlook.exealzip.exebandizip.exebreadzip.exe7z.exewinrar.exewinzip.exewlmail.exemsimn.exemicrosoftedge.exemicrosoftedgecp.exefirefox.exeopera.exesafari.exewebkit2webprocess.exewscript.execscript.execonhost.execmd.exepowershell.exepowershell_ise.exeucbrowser.exespark.exe
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10014c8f
cmp byte [0x1015788a], 0
jne 0x10014c8f
mov byte [0x1015162c], 1
test byte [0x10157880], 0x10
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
jne 0x10014e2e
cmp dword [0x10152cdc], 0x10
jae 0x10014e2e
xor edi, edi
mov byte [0x10151888], 0
cmp dword [0x10151880], edi
jne 0x10014e43
lea eax, [esp + 0x3c]
push eax
push edi
push edi
push 0x1000e4fc
push edi
push edi
call fcn.1004592d
add esp, 0x18
mov dword [0x10151880], eax
jmp 0x10014e43
cmp byte [0x10152ad8], 0
mov ebx, 0x3ff
jne 0x10014d8a
push ebx
lea eax, [esp + 0xf55]
push 0
push eax
mov byte [esp + 0xf5c], 0
call fcn.10045030
push ebx
lea eax, [esp + 0x8fd]
push 0
push eax
mov byte [esp + 0x904], 0
call fcn.10045030
mov esi, 0x10060ec9
push esi
push 0x100627f4
lea eax, [esp + 0x90c]
push eax
push 0x10155228
call fcn.10040259
push esi
push 0x10063a50
lea eax, [esp + 0xf80]
push eax
lea eax, [esp + 0x920]
push eax
call fcn.10040259
push esi
push edi
lea eax, [esp + 0x92c]
push eax
lea eax, [esp + 0xf94]
push eax
call fcn.10040259
add esp, 0x48
lea eax, [esp + 0x8ec]
push ebp
push eax
call fcn.1002ce47
pop ecx
pop ecx
jmp 0x10014d8f
mov esi, 0x10060ec9
push 0x10063eac
push ebp
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10014e1b
push str.bandisoft
push ebp
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10014e1b
push 0x10063e98
push ebp
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10014e1b
mov byte [0x10078497], 0
mov byte [0x10151897], 1
jmp 0x100149aa
mov eax, dword [0x10151880]
xor edi, edi
cmp eax, edi
je 0x10014e43
push edi
push eax
call esi
mov dword [0x10151880], edi
test dword [0x1015786c], 0x40000000
jne 0x10014e74
cmp dword [0x1015187c], edi
jne 0x10014e87
lea eax, [esp + 0x3c]
push eax
push edi
push edi
push 0x1000da2f
push edi
push edi
call fcn.1004592d
add esp, 0x18
mov dword [0x1015187c], eax
jmp 0x10014e87
mov eax, dword [0x1015187c]
cmp eax, edi
je 0x10014e87
push edi
push eax
call esi
mov dword [0x1015187c], edi
mov al, 1
jmp 0x1001147c