Function at 0x1001ed22
Capabilities:
Accept command line arguments
Create thread
Terminate process
Terminate thread

Disassembly:
mov eax, 0x10344
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, esp
mov dword [esp + 0x10340], eax
push ebx
push ebp
push esi
push edi
call fcn.10010248
xor ebp, ebp
mov byte [0x1013eeb7], al
cmp dword [0x1029e404], ebp
jne 0x1001ed63
push str.TC_Sign
push ebp
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x1029e404], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, 0x10142848
cmp ebx, ebp
je 0x1001edda
cmp byte [ebx], 0
je 0x1001edda
push str.rundll32.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
je 0x1001ed9f
push 0x10063b10
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1001edda
mov edi, 0x10063830
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001eda9
sub eax, edx
je 0x1001edda
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001ee54
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001edc9
sub eax, ecx
lea edi, [edi + eax + 1]
cmp edi, ebp
jne 0x1001eda4
push str.spoolsv.exe
push esi
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1001edf2
mov byte [0x1013dc01], 1
call fcn.1000d58f
mov edi, 0x1005ce9d
cmp dword [0x101434ac], ebp
je 0x1001ee27
mov eax, dword [0x10162588]
cmp eax, ebp
jne 0x1001ee0f
mov eax, edi
mov ecx, ebx
cmp ebx, ebp
jne 0x1001ee17
mov ecx, edi
push eax
push ecx
push str.GetCommandLine__s_GetExpCmdLine__s_...
push ebp
call fcn.1003dfed
add esp, 0x10
cmp ebx, ebp
je 0x1001ee7f
mov esi, 0x10162588
cmp byte [ebx], 0
je 0x1001ee7f
mov eax, dword [esi]
cmp eax, ebp
je 0x1001ee7f
cmp esi, 0x10162d88
jge 0x1001ee7f
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001ee70
add esi, 4
jmp 0x1001ee30
cmp dword [0x101434ac], ebp
je 0x1001ee69
push str.OK_NOBHKOK_Except_CommandLine._rundll32.exe_or_dllhost.exe_ran_at_Exceptsigner
push ebp
call fcn.1003dfed
pop ecx
pop ecx
xor al, al
jmp 0x10021a3a
cmp dword [0x101434ac], ebp
je 0x1001ee69
push str.OK_NOBHKOK_Except_CommandLine_Hook1
jmp 0x1001ee61
call fcn.1000d78a
cmp dword [0x101434ac], ebp
je 0x1001eea6
mov eax, dword [0x10160988]
cmp eax, ebp
jne 0x1001ee97
mov eax, edi
push eax
push str.GetExpDefault__s_...
push ebp
call fcn.1003dfed
add esp, 0xc
cmp dword [0x10160988], ebp
je 0x1001eed7
mov esi, 0x10160988
cmp esi, 0x10161188
jge 0x1001eed7
push dword [esi]
push 0x10142848
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001f28c
add esi, 4
cmp dword [esi], ebp
jne 0x1001eeb3
mov edi, 0x4fff
push edi
xor esi, esi
lea eax, [esp + 0xf55]
push esi
push eax
mov byte [esp + 0xf5c], 0
call fcn.10040850
push edi
lea eax, [esp + 0x6361]
push esi
push eax
mov byte [esp + 0x6368], 0
call fcn.10040850
push 6
push str.tc_Protocol
mov edi, str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push edi
mov ebp, reloc.WS2_32.dll_bind
push ebp
call fcn.1003d897
push esi
push str.tc_CUT_LOG_SEND_SERVER
push edi
push ebp
mov dword [0x1013ee98], eax
call fcn.1003d897
push esi
push str.tc_Option1
mov ebx, str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push ebx
push ebp
mov dword [0x1013ee9c], eax
call fcn.1003d897
add esp, 0x48
push esi
push str.tc_EdrL
push ebx
push ebp
mov dword [0x1013ee8c], eax
call fcn.1003d897
mov esi, 0x200
push esi
mov edi, 0x101104b0
push edi
mov dword [0x1013ee90], eax
call fcn.100074a5
push esi
push edi
push str.tc_GW
push str.SOFTWARETrojanCut_tc_Env
push ebp
call fcn.1003e4ea
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x1001ef99
mov byte [0x101104b0], 0
mov edi, 0x5000
lea eax, [esp + 0xf50]
push edi
push eax
call fcn.100074a5
push edi
lea eax, [esp + 0xf5c]
push eax
push str.tc_EDRLTraceExt
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x1001efd1
mov byte [esp + 0xf50], 0
push esi
mov esi, 0x10156368
push esi
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x1001f019
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.1003d5c8
cmp dword [0x101434ac], 0
pop ecx
pop ecx
je 0x1001f012
push esi
push str.tc_EDRLTraceExt_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push esi
call fcn.10040b28
pop ecx
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.Office16
mov esi, 0x10142448
push esi
call edi
test eax, eax
jne 0x1001f03c
push str.Office19
push esi
call edi
test eax, eax
je 0x1001f043
mov byte [0x10144ec3], 1
push 0x400
push 0
push 0x10103288
call fcn.10040850
add esp, 0xc
test byte [0x1013ee90], 1
jne 0x1001f06d
cmp byte [0x10144ec3], 0
je 0x1001f2b0
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push dword [0x1016e468]
movzx eax, word [esp + 0x34]
push eax
movzx eax, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x38]
push eax
movzx eax, word [esp + 0x3a]
push eax
movzx eax, word [esp + 0x3a]
push eax
movzx eax, word [esp + 0x3c]
push eax
push str._04d__02d__02d__02d:_02d:_02d__d
push 0x1013cfe0
call fcn.10040b98
add esp, 0x24
test byte [0x1013ee90], 0x10
je 0x1001f10f
push 0
push dword [esp + 0x1c]
push esi
push 0x1000
call fcn.100363ed
add esp, 0x10
and dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x18], eax
test eax, eax
je 0x1001f2a2
xor eax, eax
inc eax
cmp dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
jle 0x1001f280
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x1001f26e
cmp word [eax], 0
je 0x1001f26e
push eax
lea ecx, [esp + 0xa6c]
call fcn.1001ed09
mov ecx, dword [eax]
lea edx, [esp + 0x868]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x1001f176
lea eax, [esp + 0xa6c]
cmp dword [esp + 0xa68], eax
je 0x1001f19d
push dword [esp + 0xa68]
call fcn.100425b3
pop ecx
lea esi, [esp + 0x868]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f1a9
sub eax, edx
cmp eax, 2
jbe 0x1001f1ff
cmp byte [esp + 0x868], 0x22
jne 0x1001f1ff
lea eax, [esp + 0x868]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f1cb
sub eax, edx
lea edi, [esp + 0x868]
dec edi
cmp byte [edi + eax], 0x22
jne 0x1001f1ff
lea eax, [esp + 0x868]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f1ec
sub eax, edx
mov byte [edi + eax], cl
lea esi, [esp + 0x869]
push esi
call fcn.1003d69f
pop ecx
test eax, eax
je 0x1001f26e
cmp byte [0x10144ec3], 0
je 0x1001f22a
push esi
call fcn.10007344
pop ecx
push eax
push 0
push 0
push esi
mov ecx, 0x10171a78
call fcn.1002864d
cmp dword [0x101434ac], 0x48
jne 0x1001f243
push esi
push str.SendInfoDisplayEDRL_GetCommandLineW_:___s_
push 0
call fcn.1003dfed
add esp, 0xc
test byte [0x1013ee90], 1
je 0x1001f26e
mov edx, 0x10103288
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001f255
push 1
push 0
push esi
push 1
call fcn.10035eb6
add esp, 0x10
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x1c]
jl 0x1001f143
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001f2b0
cmp dword [0x101434ac], ebp
je 0x1001ee69
push str.OK_NOBHKOK_Except_Default_Hook1
jmp 0x1001ee61
push str.errr_CommandLineToArgvW_null
push 0
call fcn.1003dfed
pop ecx
pop ecx
xor esi, esi
push esi
push str.tc_Cut_List
push ebx
push ebp
call fcn.1003d897
add esp, 0x10
test dword [0x1013ee8c], 0x800
mov dword [0x1013ee94], eax
mov byte [0x10144691], 0
je 0x1001f2e5
test al, 2
jne 0x1001f2e5
mov byte [0x10144691], 1
cmp dword [0x101434ac], esi
je 0x1001f303
movzx eax, byte [0x10144691]
push eax
push str.g_bBackUp___d_
push esi
call fcn.1003dfed
add esp, 0xc
push esi
push str.tc_DEMO
push str.SOFTWARETrojanCut_tc_Env
push ebp
call fcn.1003d897
push esi
push str.tc_Add
push ebx
push ebp
mov dword [0x102a851c], eax
call fcn.1003d897
add esp, 0x20
mov dword [0x10141c3c], eax
cmp eax, 0x40
jae 0x1001f339
mov dword [0x10141c3c], esi
push esi
push str.tc_PCTIME
push ebx
push ebp
call fcn.1003d897
add esp, 0x10
mov dword [0x10144ef4], eax
cmp dword [0x101434ac], esi
je 0x1001f57e
mov esi, 0x100635f8
test al, 0x40
mov edi, 0x100635f4
mov eax, esi
jne 0x1001f36c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL___s_
push 0
call fcn.1003dfed
add esp, 0xc
test byte [0x10144ef4], 0x80
mov eax, esi
jne 0x1001f389
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x40000
mov eax, esi
jne 0x1001f3a9
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_HIGHST__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x100
mov eax, esi
jne 0x1001f3c9
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_MID__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x200
mov eax, esi
jne 0x1001f3e9
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_HIGH__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x1000000
mov eax, esi
jne 0x1001f409
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_HIGHST__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x400
mov eax, esi
jne 0x1001f429
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_MID__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x800
mov eax, esi
jne 0x1001f449
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_HIGH__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x2000000
mov eax, esi
jne 0x1001f469
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_HIGHST__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x1000
mov eax, esi
jne 0x1001f489
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_MID__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x2000
mov eax, esi
jne 0x1001f4a9
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_HIGH__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x4000000
mov eax, esi
jne 0x1001f4c9
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_HIGHST__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x4000
mov eax, esi
jne 0x1001f4e9
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_MID__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x8000
mov eax, esi
jne 0x1001f509
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_HIGH__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x8000000
mov eax, esi
jne 0x1001f529
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_HIGHST__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x10000
mov eax, esi
jne 0x1001f549
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_MID__s_
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144ef4], 0x20000
jne 0x1001f567
mov esi, edi
push esi
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_HIGH__s_
push 0
call fcn.1003dfed
mov eax, dword [0x10144ef4]
add esp, 0xc
xor esi, esi
mov edx, 0x1111
test al, 0x40
je 0x1001f61e
test al, al
jns 0x1001f5bf
mov ecx, eax
and ecx, 0x200
je 0x1001f5a0
test eax, 0x100
jne 0x1001f61e
cmp ecx, esi
je 0x1001f5ac
or dword [0x1013dc2c], edx
jmp 0x1001f628
test eax, 0x40000
jne 0x1001f609
or dword [0x1013dc2c], 0x1014
jmp 0x1001f628
mov edi, 0x1000
or dword [0x1013dc2c], edi
test eax, 0x1000000
je 0x1001f5db
and dword [0x1013dc2c], 0xffffefff
mov ecx, eax
and ecx, 0x2000
je 0x1001f5f2
test edi, eax
je 0x1001f5f2
or dword [0x1013dc2c], 0x12
jmp 0x1001f628
cmp ecx, esi
je 0x1001f602
or dword [0x1013dc2c], 0x111
jmp 0x1001f628
test eax, 0x2000000
je 0x1001f615
or dword [0x1013dc2c], 0x101
jmp 0x1001f628
or dword [0x1013dc2c], 0x14
jmp 0x1001f628
or dword [0x1013dc2c], 0x1012
mov ecx, dword [0x10144edc]
cmp ecx, esi
je 0x1001f63d
cmp ecx, 0x40
jae 0x1001f63d
mov dword [0x1013dc2c], edx
cmp dword [0x101434ac], esi
je 0x1001f6e8
push dword [0x1013dc2c]
push eax
push str.g_tc_PCTIME_0x_08x__g_TC_SECURITY_0x_08x_
push esi
call fcn.1003dfed
add esp, 0x10
test byte [0x1013dc2c], 1
je 0x1001f674
push str.TC_SECURITY_COMM_RAW_on
push esi
call fcn.1003dfed
pop ecx
pop ecx
test byte [0x1013dc2c], 2
je 0x1001f68a
push str.TC_SECURITY_COMM_NOR_on
push esi
call fcn.1003dfed
pop ecx
pop ecx
test byte [0x1013dc2c], 4
je 0x1001f6a0
push str.TC_SECURITY_COMM_LOW_on
push esi
call fcn.1003dfed
pop ecx
pop ecx
test byte [0x1013dc2c], 0x10
je 0x1001f6b6
push str.TC_SECURITY_FLT_FILE_on
push esi
call fcn.1003dfed
pop ecx
pop ecx
test dword [0x1013dc2c], 0x100
je 0x1001f6cf
push str.TC_SECURITY_FLT_PACKET_128byte
push esi
call fcn.1003dfed
pop ecx
pop ecx
test dword [0x1013dc2c], 0x1000
je 0x1001f6e8
push str.TC_SECURITY_FLT_LOG_10sec
push esi
call fcn.1003dfed
pop ecx
pop ecx
push str.MIN_FILE_SIZE
push 0x400
mov eax, 0x100
push 0x200
push eax
push eax
call fcn.10001508
mov edi, str.sLog_tmpnAttackRateVal
push edi
mov esi, 0x190
push esi
push 0x12c
push 0xc8
push 0x64
mov dword [0x100cb984], eax
call fcn.10001508
push edi
mov dword [0x1013dc1c], eax
push esi
mov eax, 0xc8
push eax
push eax
push 0x64
call fcn.10001508
push edi
push 0xfa0
push 0x7d0
push 0x3e8
push 0x1f4
mov dword [0x10072490], eax
call fcn.10001508
add esp, 0x50
push 2
push str.tc_STEALTH
push ebx
push ebp
mov dword [0x1007248c], eax
call fcn.1003d897
add esp, 0x10
mov dword [0x10072cd0], eax
test eax, 0xff000000
je 0x1001f786
and eax, 0xfffffff8
mov dword [0x10072cd0], eax
push 0
push str.tc_SvrAgent
push ebx
push ebp
call fcn.1003d897
push 2
push str.tc_Sierra
push ebx
push ebp
mov dword [0x1013f2d8], eax
call fcn.1003d897
or edi, 0xffffffff
push edi
push str.tc_Attachsize
push ebx
push ebp
mov dword [0x1013f2d4], eax
call fcn.1003d897
push edi
push str.tc_Bodysize
push ebx
push ebp
mov dword [0x10144ef0], eax
call fcn.1003d897
add esp, 0x40
push edi
push str.tc_BodyAttachsize
push ebx
push ebp
mov dword [0x10144ef8], eax
call fcn.1003d897
mov dword [0x10144efc], eax
mov esi, 0x5000
push esi
lea eax, [esp + 0xf64]
push eax
push str.tc_OKMsg
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x24
cmp eax, edi
jne 0x1001f811
mov byte [esp + 0xf50], 0
push 0x200
push 0x10143248
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x1001f840
lea eax, [esp + 0xf50]
push 0x10143248
push eax
call fcn.1003d5c8
pop ecx
pop ecx
push esi
lea eax, [esp + 0xf54]
push eax
push str.tc_OKWebMail
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, edi
jne 0x1001f864
mov byte [esp + 0xf50], 0
push 0x200
mov edi, 0x1015cb88
push edi
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x1001f890
lea eax, [esp + 0xf50]
push edi
push eax
call fcn.1003d5c8
pop ecx
pop ecx
xor edi, edi
push edi
push str.tc_NoINTERNET
push ebx
push ebp
call fcn.1003d897
push edi
push str.tc_UNUSETYPE
push ebx
push ebp
mov dword [0x10144698], eax
call fcn.1003d897
push edi
push str.tc_ReadOnlyTYPE
push ebx
push ebp
mov dword [0x1014469c], eax
call fcn.1003d897
push 0x12014000
push str.tc_WTYPE
push ebx
push ebp
mov dword [0x101446ac], eax
call fcn.1003d897
add esp, 0x40
mov dword [0x101446a0], eax
test eax, eax
js 0x1001f931
test dword [0x10072cd0], 0x100000
je 0x1001f931
cmp dword [0x10140300], 0x10000
jae 0x1001f931
cmp byte [0x10144ec0], 0
jne 0x1001f931
cmp byte [0x101400f5], 0
jne 0x1001f931
cmp dword [0x1029e404], edi
je 0x1001f931
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 2
push 0x179f
push dword [0x1029e404]
call dword [sym.imp.USER32.dll_PostMessageA]
mov edi, 0x2800
push edi
push 0x10162d88
call fcn.100074a5
push 0x1000
push 0x10165588
call fcn.100074a5
push edi
push 0x1015cd88
call fcn.100074a5
push 0x64
push 0x1016bbf8
call fcn.100074a5
add esp, 0x20
cmp dword [0x10144ecc], 0
je 0x1001fb8d
test dword [0x101446a0], 0x10000000
jne 0x1001fb8d
push esi
lea eax, [esp + 0xf54]
push eax
push str.tc_OKURL
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001f9ac
mov byte [esp + 0xf50], 0
push esi
lea eax, [esp + 0xb354]
push eax
push str.tc_OKURLForm
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001f9d1
mov byte [esp + 0xb350], 0
cmp byte [esp + 0xf50], 0
jne 0x1001f9e9
cmp byte [esp + 0xb350], 0
je 0x1001fb6b
lea eax, [esp + 0x6350]
push esi
push eax
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x1001fa1a
lea eax, [esp + 0x6350]
push eax
lea eax, [esp + 0xf54]
push eax
call fcn.1003d5c8
pop ecx
pop ecx
cmp byte [esp + 0xb350], 0
je 0x1001fa74
cmp byte [esp + 0xf50], 0
je 0x1001fa4a
lea edi, [esp + 0x6350]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1001fa36
mov esi, 0x1005f2ac
movsw word es:[edi], word [esi]
mov esi, 0x5000
lea eax, [esp + 0x6350]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001fa54
sub eax, edx
lea eax, [esp + eax + 0x6350]
push eax
lea eax, [esp + 0xb354]
push eax
call fcn.1003d5c8
pop ecx
pop ecx
xor eax, eax
mov cl, byte [esp + eax + 0x6350]
mov byte [eax + 0x10162d88], cl
inc eax
test cl, cl
jne 0x1001fa76
cmp dword [0x101434ac], 0
je 0x1001faa5
push 0x10162d88
push str.TYPE_INTERNETURL_g_tc_OKURL_List___s_
push 0
call fcn.1003dfed
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x6350]
mov dword [0x10165588], 0x10162d88
inc ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001fabc
sub eax, edi
cmp eax, 1
jbe 0x1001fb14
mov dword [esp + 0x10], 0x1016558c
cmp dword [esp + 0x10], 0x10166588
jge 0x1001fb14
lea eax, [ecx + 0x10162d89]
cmp byte [eax - 1], 0x3a
jne 0x1001fafc
cmp byte [eax], 0
mov byte [eax - 1], 0
je 0x1001fafc
mov edx, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [edx], eax
lea eax, [esp + 0x6350]
inc ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001fb07
sub eax, edi
cmp ecx, eax
jb 0x1001fad2
cmp dword [0x101434ac], 0
je 0x1001fb51
xor edi, edi
cmp dword [0x10165588], edi
je 0x1001fb51
cmp edi, 0x400
jge 0x1001fb51
push dword [edi*4 + 0x10165588]
push edi
push str.g_ptc_OKURL_List___d___s_
push 0
call fcn.1003dfed
add esp, 0x10
inc edi
cmp dword [edi*4 + 0x10165588], 0
jne 0x1001fb27
lea eax, [esp + 0x6350]
push eax
push 0x100630d0
push 0x1015cd88
call fcn.10040b98
add esp, 0xc
push 0x64
push 0x1016bbf8
push str.tc_RedirectURL
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001fb8d
mov byte [0x1016bbf8], 0
cmp byte [0x10144ec0], 0
je 0x1001fbb8
push 0x64
push 0x1016bbf8
push str.tc_RedirectURL
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001fbb8
mov byte [0x1016bbf8], 0
push 0x64
push 0x1016bb90
push str.tc_PopBlackURL
push ebx
push ebp
call fcn.1003e4ea
or edi, 0xffffffff
add esp, 0x14
cmp eax, edi
jne 0x1001fbdc
mov byte [0x1016bb90], 0
push 0x64
push 0x10143448
push str.tc_PopMailMsg
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, edi
jne 0x1001fbfd
mov byte [0x10143448], 0
push 0x64
push 0x101434b0
push str.tc_PopMailSizeMsg
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, edi
jne 0x1001fc1e
mov byte [0x101434b0], 0
push 0x64
push 0x10143518
push str.tc_PopRansomMsg
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, edi
jne 0x1001fc3f
mov byte [0x10143518], 0
push 0x104
push 0x10143580
push str.tc_BackUpFolder
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, edi
jne 0x1001fc63
mov byte [0x10143580], 0
push 0x400
push 0x10145710
push str.tc_sLocalIP
mov edi, str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push edi
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001fc8d
mov byte [0x10145710], 0
push 0x400
push 0x10145b10
push str.tc_sWebIP
push edi
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001fcb2
mov byte [0x10145b10], 0
push 0x400
push 0x10144f10
push str.TC_User_name
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001fcdb
mov byte [0x10144f10], 0
push 0x400
push 0x10145310
push str.TC_User_office
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001fd04
mov byte [0x10145310], 0
mov al, byte [0x10145310]
test al, al
je 0x1001fd11
cmp al, 0x20
jne 0x1001fd3a
push 0x400
push 0x10145310
push str.TC_Org
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001fd3a
mov byte [0x10145310], 0
mov al, byte [0x10145310]
test al, al
je 0x1001fd47
cmp al, 0x20
jne 0x1001fd70
push 0x400
push 0x10145310
push str.TC_Section
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001fd70
mov byte [0x10145310], 0
cmp dword [0x102a851c], 0
jne 0x1001fd8f
test dword [0x10144ef4], 0x40000
mov dword [0x10073e34], 0x3c
je 0x1001fd99
mov dword [0x10073e34], 5
push 3
push str.tc_TCD
push ebx
push ebp
call fcn.1003d897
add esp, 0x10
mov dword [0x10072cdc], eax
test eax, eax
jne 0x1001fdbd
mov dword [0x10072cdc], 1
push 0x2000
push str.tc_FILE_SEND_SERVER
push edi
push ebp
call fcn.1003d897
push 5
push str.tc_CONNECT_POLLING_TIME
push edi
push ebp
mov dword [0x10072cc0], eax
call fcn.1003d897
push 1
push str.tc_FILE_EXP
push ebx
push ebp
mov dword [0x10072cd4], eax
mov byte [0x10072cba], 0
call fcn.1003d897
push 0
push str.tc_CARE
test eax, eax
setne al
push ebx
push ebp
mov byte [0x10141c39], al
call fcn.1003d897
mov dword [0x10144688], eax
shr eax, 0x14
and eax, 0xf
add esp, 0x40
imul eax, eax, 0xa
push 0
push str.tc_ALLNOCUT
push ebx
push ebp
mov dword [0x1014468c], eax
call fcn.1003d897
push 0
push str.tc_PER
push ebx
push ebp
mov dword [0x10144694], eax
call fcn.1003d897
push 0
push str.tc_EachNoCut_Per
test eax, eax
setne al
push ebx
push ebp
mov byte [0x10144693], al
call fcn.1003d897
push 0x14
push str.tc_DDX_H_Q
push ebx
push ebp
mov dword [0x1013dc28], eax
call fcn.1003d897
add esp, 0x40
push 2
push str.tc_DDX_H_S
push ebx
push ebp
mov dword [0x10073e14], eax
call fcn.1003d897
push 0x14
push str.tc_DDX_H_G
push ebx
push ebp
mov dword [0x10073e18], eax
call fcn.1003d897
push 0x14
push str.tc_DDX_T_C
push ebx
push ebp
mov dword [0x10073e1c], eax
call fcn.1003d897
push 2
push str.tc_DDX_T_S
push ebx
mov dword [0x10073e20], eax
push ebp
call fcn.1003d897
add esp, 0x40
push 0x14
push str.tc_DDX_U
push ebx
push ebp
mov dword [0x10073e24], eax
call fcn.1003d897
push 1
push str.tc_DDX_I
push ebx
push ebp
mov dword [0x10073e28], eax
call fcn.1003d897
push 3
push str.tc_DDX_S
push ebx
push ebp
mov dword [0x10073e2c], eax
call fcn.1003d897
push 0
push str.tc_W_L
push ebx
push ebp
mov dword [0x10073e30], eax
call fcn.1003d897
add esp, 0x40
push 0
push str.tc_DDOS_KILL
push ebx
push ebp
mov dword [0x10144f00], eax
call fcn.1003d897
push 0
push str.tc_DDOS_AP
push ebx
push ebp
mov dword [0x101446a4], eax
call fcn.1003d897
push 0
push str.tc_Speed
test eax, eax
setne al
push ebx
push ebp
mov byte [0x10144692], al
call fcn.1003d897
mov ecx, eax
and ecx, 0x101000
mov dword [0x10140b8c], ecx
mov ecx, eax
shr ecx, 0x11
and cl, 1
mov byte [0x10140305], cl
mov ecx, eax
and ecx, 0x21e000
mov dword [0x100724b4], ecx
mov ecx, eax
push 0
mov dword [0x10148b18], eax
push str.tc_WaterMark
shr ecx, 0x12
shr eax, 0x13
and cl, 1
and al, 1
push ebx
push ebp
mov byte [0x10140306], cl
mov byte [0x10140307], al
call fcn.1003d897
add esp, 0x40
push 0
push str.tc_WM_Height
push ebx
push ebp
mov dword [0x10148b1c], eax
call fcn.1003d897
push 0
push str.tc_WM_Blend
mov dword [0x10136ed8], eax
push ebx
push ebp
call fcn.1003d897
push 0
push str.tc_India
push edi
push ebp
mov dword [0x10136edc], eax
call fcn.1003d897
push 0
push str.tc_IndiaSystem
push edi
push ebp
mov dword [0x1016e690], eax
call fcn.1003d897
mov dword [0x1016e694], eax
mov eax, dword [0x10136edc]
add esp, 0x40
test eax, eax
jle 0x10020010
cmp eax, 0xff
jle 0x1002001a
mov dword [0x10136edc], 0x80
push 0
push str.tc_WM_S_FontSize
push ebx
push ebp
call fcn.1003d897
add esp, 0x10
mov dword [0x10136ed0], eax
test eax, eax
jle 0x1002003b
cmp eax, 0x1f4
jle 0x10020045
mov dword [0x10136ed0], 0xc8
push 0
push str.tc_WM_S_FontWeight
push ebx
push ebp
call fcn.1003d897
add esp, 0x10
cmp eax, 0x64
mov dword [0x1013dbe0], eax
jl 0x10020067
cmp eax, 0x384
jle 0x10020071
mov dword [0x1013dbe0], 0x2bc
push 0
push str.tc_WM_S_FontColor
push ebx
push ebp
call fcn.1003d897
push 0x1ff
mov dword [0x100cb980], eax
lea eax, [esp + 0xd65]
push 0
push eax
mov byte [esp + 0xd6c], 0
call fcn.10040850
add esp, 0x1c
mov edi, 0x200
push edi
lea eax, [esp + 0xd54]
push eax
push 0x6d
push dword [0x102bc550]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x400
push 0x10148b20
push str.tc_WM_S_FontName
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100200f1
lea eax, [esp + 0xd50]
push eax
push 0x10148b20
call fcn.100074d8
pop ecx
pop ecx
test byte [0x10148b1c], 1
je 0x10020132
cmp byte [0x10148b20], 0
jne 0x10020132
lea eax, [esp + 0xd50]
push eax
push 0x10148b20
call fcn.100074d8
and dword [0x100cb980], 0
pop ecx
pop ecx
mov dword [0x10136ed0], 0xa
mov dword [0x1013dbe0], 0x2bc
push edi
lea eax, [esp + 0xd54]
push eax
push 0x6e
push dword [0x102bc550]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x400
push 0x10148f20
push str.tc_WM_S_String
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1002017b
lea eax, [esp + 0xd50]
push eax
push 0x10148f20
call fcn.100074d8
pop ecx
pop ecx
push 0
push str.tc_DELTOOLBAR
push ebx
push ebp
call fcn.1003d897
push 0
push str.tc_DetectType
push ebx
push ebp
mov dword [0x1015bd84], eax
call fcn.1003d897
push edi
push 0x10143688
push str.TC_TCServer
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
mov dword [0x1015bd80], eax
call fcn.1003e4ea
add esp, 0x34
cmp eax, 0xffffffff
jne 0x100201c6
mov byte [0x10143688], 0
push str.ruecut
push 0x10143688
mov byte [0x1013dc0b], 0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100201e8
mov byte [0x1013dc0b], 1
push edi
push 0x10143888
push str.TC_PatchServer
push str.SOFTWARETrueCut_tc_INSTALL
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1002020d
mov byte [0x10143888], 0
push 1
push str.tc_COMMIT_POPUP
push ebx
push ebp
call fcn.1003d897
push 1
push str.tc_COMMIT_LIST
push ebx
push ebp
mov dword [0x10072cbc], eax
call fcn.1003d897
or dword [0x10072cbc], eax
push 1
push str.tc_COMMIT_LOG_SAVEFILE
push ebx
push ebp
call fcn.1003d897
or dword [0x10072cbc], eax
push 1
push str.tc_Cut_USB
push ebx
push ebp
call fcn.1003d897
add esp, 0x40
push 1
push str.tc_PE_IE
push ebx
push ebp
mov byte [0x10141c3a], al
call fcn.1003d897
add esp, 0x10
test eax, eax
setne al
test dword [0x10144688], 0x80000000
mov byte [0x10141c3b], al
push 0x111111
je 0x10020291
push str.tc_AutoEngine
jmp 0x10020296
push str.tc_Engine
push ebx
push ebp
call fcn.1003d897
add esp, 0x10
mov dword [0x10072cc4], eax
test eax, eax
jne 0x100202b3
mov dword [0x10072cc4], 0x111111
push 0
push str.tc_fasoo
push str.SOFTWARETrojanCut_tc_Env
push ebp
call fcn.1003d897
mov dword [0x10140308], eax
lea eax, [esp + 0xf60]
push esi
push eax
call fcn.100074a5
push esi
lea eax, [esp + 0xf6c]
push eax
push str.tc_ExceptIP
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x100202fd
mov byte [esp + 0xf50], 0
push 0x600
push 0x1014b960
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x10020354
lea eax, [esp + 0xf50]
push 0x1014b960
push eax
call fcn.1003d5c8
cmp dword [0x101434ac], 0
pop ecx
pop ecx
je 0x10020349
push 0x1014b960
push str.tc_ExceptIP_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push 0x1014b960
call fcn.1001003e
pop ecx
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.100074a5
push esi
lea eax, [esp + 0xf5c]
push eax
push str.tc_FileExtExp
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10020387
mov byte [esp + 0xf50], 0
push edi
push 0x10155f68
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x100203da
lea eax, [esp + 0xf50]
push 0x10155f68
push eax
call fcn.1003d5c8
cmp dword [0x101434ac], 0
pop ecx
pop ecx
je 0x100203cf
push 0x10155f68
push str.tc_FileExtExp_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push 0x10155f68
call fcn.10040b28
pop ecx
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.100074a5
push esi
lea eax, [esp + 0xf5c]
push eax
push str.tc_FileExtCut
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x1002040d
mov byte [esp + 0xf50], 0
push edi
mov edi, 0x10156168
push edi
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x10020455
lea eax, [esp + 0xf50]
push edi
push eax
call fcn.1003d5c8
cmp dword [0x101434ac], 0
pop ecx
pop ecx
je 0x1002044e
push edi
push str.tc_FileExtCut_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push edi
call fcn.10040b28
pop ecx
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.100074a5
push esi
lea eax, [esp + 0xf5c]
push eax
push str.tc_ExceptDLLs
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10020488
mov byte [esp + 0xf50], 0
push 0x1000
mov edi, 0x1014a960
push edi
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x100204d4
lea eax, [esp + 0xf50]
push edi
push eax
call fcn.1003d5c8
push edi
call fcn.10042449
add esp, 0xc
cmp dword [0x101434ac], 0
je 0x100204d4
push edi
push str.tc_ExceptDLLs_:__s
push 0
call fcn.1003dfed
add esp, 0xc
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.100074a5
push esi
lea eax, [esp + 0xf5c]
push eax
push str.tc_ForceCom
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10020507
mov byte [esp + 0xf50], 0
push 0x1000
mov edi, 0x10149960
push edi
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x10020553
lea eax, [esp + 0xf50]
push edi
push eax
call fcn.1003d5c8
push edi
call fcn.10042449
add esp, 0xc
cmp dword [0x101434ac], 0
je 0x10020553
push edi
push str.tc_ForceCom_:__s
push 0
call fcn.1003dfed
add esp, 0xc
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.100074a5
mov edi, 0x800
push edi
push 0xffffffffffffffff
push 0x100c0180
call fcn.10040850
push edi
push 0xffffffffffffffff
push 0x1010daa0
call fcn.10040850
push edi
push 0xffffffffffffffff
push 0x1013d1e0
call fcn.10040850
push edi
push 0x10156568
call fcn.100074a5
and dword [0x10156d68], 0
and dword [0x10156d6c], 0
push esi
lea eax, [esp + 0xf88]
push eax
push str.tc_RansomFileType
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x48
cmp eax, 0xffffffff
jne 0x100205cb
mov byte [esp + 0xf50], 0
cmp byte [esp + 0xf50], 0
je 0x100206f8
lea eax, [esp + 0xf50]
push 0x10156568
push eax
call fcn.1003d5c8
cmp dword [0x101434ac], 0
pop ecx
pop ecx
je 0x1002060a
push 0x10156568
push str.g_tc_RansomFree_Process_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push 0x10062cbc
push 0x10156568
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [0x10156d68], eax
test eax, eax
je 0x10020631
mov byte [eax], 0
mov eax, dword [0x10156d68]
inc eax
mov dword [0x10156d68], eax
push 0x10062cbc
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [0x10156d6c], eax
test eax, eax
je 0x1002064f
mov byte [eax], 0
inc dword [0x10156d6c]
push 0x200
push 0x100c0180
push 0x3a
push 0x10156568
call fcn.1003d430
mov eax, dword [0x10156d68]
add esp, 0x10
test eax, eax
je 0x10020686
push 0x200
push 0x1010daa0
push 0x3a
push eax
call fcn.1003d430
add esp, 0x10
mov eax, dword [0x10156d6c]
test eax, eax
je 0x100206a4
push 0x200
push 0x1013d1e0
push 0x3a
push eax
call fcn.1003d430
add esp, 0x10
cmp dword [0x101434ac], 0
je 0x100206f8
cmp dword [0x100c0180], 0xffffffff
je 0x100206f8
and dword [esp + 0x10], 0
cmp dword [esp + 0x10], edi
jge 0x100206f8
mov eax, dword [esp + 0x10]
push dword [eax + 0x1013d1e0]
push dword [eax + 0x1010daa0]
push dword [eax + 0x100c0180]
push str.g_RF_AR_Process__s__g_RF_AR_Ext__s__g_RF_AR_Folder__s_
push 0
call fcn.1003dfed
add dword [esp + 0x24], 4
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp dword [eax + 0x100c0180], 0xffffffff
jne 0x100206bb
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.100074a5
cmp byte [0x1013dc0b], 0
pop ecx
pop ecx
mov eax, str.tc_ExceptProcessEnable
jne 0x1002071b
mov eax, str.tc_ExceptProcessForm
push esi
lea ecx, [esp + 0xf54]
push ecx
push eax
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1002073c
mov byte [esp + 0xf50], 0
mov edi, 0x1000
push edi
push 0xffffffffffffffff
push 0x101358d0
call fcn.10040850
push edi
push 0xffffffffffffffff
push 0x100aa980
call fcn.10040850
push edi
push 0xffffffffffffffff
push 0x1010e2a0
call fcn.10040850
push esi
mov edi, 0x1014bf60
push edi
call fcn.100074a5
push esi
push 0x10150f60
call fcn.100074a5
and dword [0x10155f64], 0
and dword [0x10155f60], 0
add esp, 0x34
cmp byte [esp + 0xf50], 0
je 0x10020b2b
lea eax, [esp + 0xf50]
push edi
push eax
call fcn.1003d5c8
pop ecx
pop ecx
xor eax, eax
mov cl, byte [eax + 0x1014bf60]
mov byte [eax + 0x10150f60], cl
inc eax
test cl, cl
jne 0x100207b0
cmp dword [0x101434ac], 0
je 0x100207da
push edi
push str.g_tc_ExceptProcess_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push 0x10062cbc
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [0x10155f60], eax
test eax, eax
je 0x1002082d
mov byte [eax], 0
inc dword [0x10155f60]
push 0x10062cbc
push dword [0x10155f60]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ecx, 0x10150f60
mov dword [0x10155f64], eax
mov esi, eax
sub ecx, eax
mov dl, byte [esi]
mov byte [esi + ecx], dl
inc esi
test dl, dl
jne 0x10020817
test eax, eax
je 0x1002082d
mov byte [eax], dl
inc dword [0x10155f64]
cmp byte [0x1013dc0b], 0
mov esi, 0x200
push esi
push 0x101358d0
je 0x1002087d
push 0x3e
push edi
call fcn.1003d430
mov eax, dword [0x10155f60]
add esp, 0x10
test eax, eax
je 0x10020866
push esi
push 0x100aa980
push 0x3e
push eax
call fcn.1003d430
add esp, 0x10
mov eax, dword [0x10155f64]
test eax, eax
je 0x100208bc
push 0x200
push 0x1010e2a0
push 0x3e
jmp 0x100208b3
push 0x3a
push edi
call fcn.1003d430
mov eax, dword [0x10155f60]
add esp, 0x10
test eax, eax
je 0x100208a2
push esi
push 0x100aa980
push 0x3a
push eax
call fcn.1003d430
add esp, 0x10
mov eax, dword [0x10155f64]
test eax, eax
je 0x100208bc
push esi
push 0x1010e2a0
push 0x3a
push eax
call fcn.1003d430
add esp, 0x10
xor edi, edi
cmp dword [0x101434ac], edi
je 0x10020928
or esi, 0xffffffff
cmp dword [0x101358d0], esi
je 0x10020928
cmp edi, 0x400
jge 0x10020928
mov eax, dword [edi*4 + 0x1010e2a0]
cmp eax, esi
jne 0x100208e9
mov eax, 0x1005ce9d
mov ecx, dword [edi*4 + 0x100aa980]
mov edx, ecx
cmp ecx, esi
jne 0x100208fb
mov edx, 0x1005ce9d
mov ecx, dword [edi*4 + 0x101358d0]
cmp ecx, esi
jne 0x1002090b
mov ecx, 0x1005ce9d
push eax
push edx
push ecx
push edi
push str.Except_Log__d__g_tc_AR_EXProcess__s__g_tc_AR_EXProcessIP__s__g_tc_AR_EXFolder__s_
push 0
call fcn.1003dfed
add esp, 0x18
inc edi
cmp dword [edi*4 + 0x101358d0], esi
jne 0x100208d1
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add dword [esp + 0x1c], 0x9534e000
lea eax, [esp + 0x24]
push eax
adc dword [esp + 0x24], 0x64
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push eax
lea eax, [esp + 0xcf8]
push str._04d__02d__02d
push eax
call fcn.10040b98
add esp, 0x14
xor esi, esi
cmp dword [0x101358d0], 0xffffffff
jmp 0x10020b21
cmp esi, 0x200
jge 0x10020b2b
mov edi, esi
shl edi, 2
push dword [edi + 0x101358d0]
push 0x10142848
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10020a49
mov eax, dword [edi + 0x1010e2a0]
cmp eax, 0xffffffff
je 0x100209e3
test eax, eax
je 0x100209e3
cmp byte [eax], 0
je 0x100209e3
push eax
push 0x10142448
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10020a49
mov eax, dword [edi + 0x100aa980]
cmp eax, 0xffffffff
je 0x100211b4
cmp byte [eax], 0
je 0x100211b4
push 0x2d
push eax
call fcn.10040730
pop ecx
pop ecx
test eax, eax
je 0x100211b4
mov esi, dword [edi + 0x100aa980]
lea eax, [esp + 0xcec]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10020a38
test cl, cl
je 0x10020a34
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10020a38
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x10020a1a
xor eax, eax
jmp 0x10020a3d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001ee69
mov esi, dword [esp + 0x18]
mov eax, dword [edi + 0x101358d0]
cmp byte [eax], 0x2a
jne 0x10020b18
mov eax, dword [edi + 0x1010e2a0]
cmp eax, 0xffffffff
je 0x10020b18
cmp byte [eax], 0
je 0x10020b18
push eax
push 0x10142448
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10020b18
mov eax, dword [edi + 0x100aa980]
cmp eax, 0xffffffff
je 0x100211e1
cmp byte [eax], 0
je 0x100211e1
push 0x2d
push eax
call fcn.10040730
pop ecx
pop ecx
test eax, eax
je 0x100211e1
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x48]
push eax
lea eax, [esp + 0xa74]
push str._04d__02d__02d
push eax
call fcn.10040b98
mov edi, dword [edi + 0x100aa980]
add esp, 0x14
lea eax, [esp + 0xa68]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10020b0b
test cl, cl
je 0x10020b07
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10020b0b
inc eax
inc eax
inc edi
inc edi
test cl, cl
jne 0x10020aed
xor eax, eax
jmp 0x10020b10
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001ee69
inc esi
cmp dword [esi*4 + 0x101358d0], 0xffffffff
mov dword [esp + 0x18], esi
jne 0x10020995
mov esi, 0x5000
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.100074a5
push esi
lea eax, [esp + 0xf5c]
push eax
push str.tc_WhiteList
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10020b63
mov byte [esp + 0xf50], 0
mov esi, 0x800
push esi
or edi, 0xffffffff
push edi
push 0x10102a88
call fcn.10040850
push esi
push edi
push 0x101374e0
call fcn.10040850
push esi
push edi
push 0x10137ee0
call fcn.10040850
push esi
push edi
push 0x1013c7e0
call fcn.10040850
push esi
push edi
push 0x101348b0
call fcn.10040850
xor eax, eax
mov edi, 0x5000
push edi
push 0x10156d70
mov dword [0x1015bd74], eax
mov dword [0x1015bd78], eax
mov dword [0x1015bd7c], eax
call fcn.100074a5
add esp, 0x44
cmp byte [esp + 0xf50], 0
je 0x10020d35
lea eax, [esp + 0xf50]
push 0x10156d70
push eax
call fcn.1003d5c8
cmp dword [0x101434ac], 0
pop ecx
pop ecx
je 0x10020c0a
push 0x10156d70
push str.g_tc_WhiteList_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push 0x10062cbc
push 0x10156d70
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [0x1015bd74], eax
test eax, eax
je 0x10020c31
mov byte [eax], 0
mov eax, dword [0x1015bd74]
inc eax
mov dword [0x1015bd74], eax
push 0x10062cbc
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [0x1015bd78], eax
test eax, eax
je 0x10020c54
mov byte [eax], 0
mov eax, dword [0x1015bd78]
inc eax
mov dword [0x1015bd78], eax
push 0x10062cbc
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [0x1015bd7c], eax
test eax, eax
je 0x10020c72
mov byte [eax], 0
inc dword [0x1015bd7c]
push 0x200
push 0x101374e0
push 0x3a
push 0x10156d70
call fcn.1003d430
mov eax, dword [0x1015bd74]
add esp, 0x10
test eax, eax
je 0x10020ca9
push 0x200
push 0x10137ee0
push 0x3a
push eax
call fcn.1003d430
add esp, 0x10
mov eax, dword [0x1015bd78]
test eax, eax
je 0x10020cc7
push 0x200
push 0x1013c7e0
push 0x3a
push eax
call fcn.1003d430
add esp, 0x10
mov eax, dword [0x1015bd7c]
test eax, eax
je 0x10020ce5
push 0x200
push 0x101348b0
push 0x3a
push eax
call fcn.1003d430
add esp, 0x10
cmp dword [0x101434ac], 0
je 0x10020d35
cmp dword [0x101374e0], 0xffffffff
je 0x10020d35
xor edi, edi
cmp edi, esi
jge 0x10020d30
push dword [edi + 0x101348b0]
push dword [edi + 0x1013c7e0]
push dword [edi + 0x10137ee0]
push dword [edi + 0x101374e0]
push str.g_WL_arName__s__g_WL_arHash__s__g_WL_arSign__s__g_WL_arFolder__s_
push 0
call fcn.1003dfed
add edi, 4
add esp, 0x18
cmp dword [edi + 0x101374e0], 0xffffffff
jne 0x10020cf9
mov edi, 0x5000
push esi
push 0xffffffffffffffff
push 0x101374e0
call fcn.10040850
push 0x200
push 0x10137ce0
call fcn.100074a5
lea eax, [esp + 0xf64]
push edi
push eax
call fcn.100074a5
push edi
lea eax, [esp + 0xf70]
push eax
push str.tc_SvrAgentDetectFolder
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x30
cmp eax, 0xffffffff
jne 0x10020d84
mov byte [esp + 0xf50], 0
cmp byte [esp + 0xf50], 0
je 0x10020db9
lea eax, [esp + 0xf50]
push 0x10137ce0
push eax
call fcn.1003d5c8
push 0x200
push 0x100cfa88
push 0x3a
push 0x10137ce0
call fcn.1003d430
add esp, 0x18
lea eax, [esp + 0xf50]
push edi
push eax
call fcn.100074a5
push edi
lea eax, [esp + 0xf5c]
push eax
push str.tc_ExceptURL_SRC
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10020dec
mov byte [esp + 0xf50], 0
push esi
mov esi, 0x1015bd88
push esi
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x10020e5b
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.1003d5c8
cmp dword [0x101434ac], 0
pop ecx
pop ecx
je 0x10020e2d
push esi
push str.g_tc_ExceptURL_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push esi
mov esi, 0x1014b960
push esi
push str._s:_s
push esi
call fcn.10040b98
add esp, 0x10
cmp dword [0x101434ac], 0
je 0x10020e5b
push esi
push str.All_ExceptIP_____s
push 0
call fcn.1003dfed
add esp, 0xc
push 0x600
mov esi, 0x1015c588
push esi
call fcn.100074a5
lea eax, [esp + 0xf58]
push edi
push eax
call fcn.100074a5
push edi
lea eax, [esp + 0xf64]
push eax
push str.tc_CutExceptIP
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x24
cmp eax, 0xffffffff
jne 0x10020e9e
mov byte [esp + 0xf50], 0
cmp byte [esp + 0xf50], 0
je 0x10020edf
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.1003d5c8
push esi
call fcn.10040b28
add esp, 0xc
cmp dword [0x101434ac], 0
je 0x10020ed8
push esi
push str.g_tc_CutExceptIP_:__s
push 0
call fcn.1003dfed
add esp, 0xc
push esi
call fcn.1001003e
pop ecx
lea eax, [esp + 0xf50]
push edi
push eax
call fcn.100074a5
push edi
lea eax, [esp + 0xf5c]
push eax
push str.tc_BlackList
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10020f12
mov byte [esp + 0xf50], 0
push 0x3ff
lea eax, [esp + 0x5f55]
push 0
push eax
mov byte [esp + 0x5f5c], 0
call fcn.10040850
mov esi, 0x400
push esi
mov edi, 0x10141790
push edi
call fcn.100074a5
push esi
push edi
push 0x10062ac8
mov esi, 0x10142448
push esi
call fcn.1000e0b5
add esp, 0x24
test eax, eax
je 0x10020f6e
push edi
lea eax, [esp + 0x5f54]
push str.:_s:
push eax
call fcn.10040b98
add esp, 0xc
cmp dword [0x101434ac], 0
je 0x10020f9a
push edi
push esi
push str.MyGetFileVersionInformation___s__s_
push 0
call fcn.1003dfed
push dword [0x10072cd8]
push str.g_isOS__08x_
push 0
call fcn.1003dfed
add esp, 0x1c
push 0x1400
mov esi, 0x1016cc60
push esi
call fcn.100074a5
pop ecx
pop ecx
call fcn.1000d3e2
cmp dword [0x101434ac], 0
je 0x10020fca
push esi
push str.g_tc_BlackList_GetBlackFile:__s
push 0
call fcn.1003dfed
add esp, 0xc
cmp byte [esp + 0xf50], 0
je 0x1002103a
cmp byte [0x1016cc60], 0
jne 0x10020fe4
mov byte [0x1016cc60], 0x3a
mov edi, 0x1016cc60
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10020fee
sub eax, esi
lea eax, [eax + 0x1016cc60]
push eax
lea eax, [esp + 0xf54]
push eax
call fcn.1003d5c8
pop ecx
pop ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002100e
cmp dword [0x101434ac], 0
mov esi, 0x1005f2ac
movsw word es:[edi], word [esi]
je 0x1002103a
push 0x1016cc60
push str.g_tc_BlackList_GetCommList:__s
push 0
call fcn.1003dfed
add esp, 0xc
test byte [0x1015bd84], 4
je 0x10021320
mov eax, 0x1016cc60
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002104f
sub eax, edx
cmp eax, 2
jbe 0x10021320
push str..dll
push 0x1016cc60
mov byte [esp + 0x1f], cl
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002123d
cmp dword [0x10141ba0], 0
jne 0x100210ce
push str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, str.EnumProcessModules
test eax, eax
je 0x100210a9
push edi
push eax
call esi
mov dword [0x10141ba0], eax
cmp dword [0x10141ba0], 0
jne 0x100210ce
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov dword [0x10141ba0], eax
test eax, eax
je 0x1002123d
mov edi, 0x800
push edi
lea eax, [esp + 0x6c]
push 0
push eax
call fcn.10040850
mov esi, 0x1ff
push esi
lea eax, [esp + 0xafd]
push 0
push eax
mov byte [esp + 0xb04], 0
call fcn.10040850
push esi
lea eax, [esp + 0x885]
push 0
push eax
mov byte [esp + 0x88c], 0
call fcn.10040850
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x18]
push ecx
push edi
lea ecx, [esp + 0x70]
push ecx
push eax
mov dword [esp + 0x2c], eax
call dword [0x10141ba0]
xor edi, edi
test eax, eax
je 0x10021233
mov eax, dword [esp + 0x18]
shr eax, 2
cmp edi, eax
jae 0x10021233
push 0x200
lea eax, [esp + 0xaf0]
push eax
push dword [esp + edi*4 + 0x70]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x868]
push eax
lea eax, [esp + 0xaf0]
push eax
call fcn.1003d08f
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
pop ecx
pop ecx
push str..dll
lea eax, [esp + 0x86c]
push eax
call esi
test eax, eax
je 0x100211b1
cmp byte [esp + 0x868], 0
je 0x100211b1
lea eax, [esp + 0x868]
push eax
push 0x1016cc60
call esi
test eax, eax
jne 0x10021209
inc edi
jmp 0x1002113e
push dword [esi*4 + 0x1010e2a0]
push dword [esi*4 + 0x101358d0]
push 0x10142448
push 0x10142848
push esi
push str.Except1__d__g_szMyExeName__s__g_szMyExeFullPath__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
push 0
call fcn.1003dfed
add esp, 0x1c
jmp 0x1001ee69
push dword [esi*4 + 0x1010e2a0]
push dword [esi*4 + 0x101358d0]
push 0x10142448
push esi
push str.Except2__d__g_szMyExeFullPath__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
push 0
call fcn.1003dfed
add esp, 0x18
jmp 0x1001ee69
cmp dword [0x101434ac], 0
je 0x1002122e
push 0x1016cc60
lea eax, [esp + 0x86c]
push eax
push str.g_tc_BlackList_Found_Module___s__in_Apps__s_
push 0
call fcn.1003dfed
add esp, 0x10
mov byte [esp + 0x17], 1
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10141790], 0
je 0x1002127a
lea eax, [esp + 0x5f50]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10021250
sub eax, edx
cmp eax, 1
jbe 0x1002127a
lea eax, [esp + 0x5f50]
push eax
push 0x1016cc60
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002127a
mov byte [esp + 0x17], 1
push 0x1000
push 0xffffffffffffffff
mov esi, 0x100ca980
push esi
call fcn.10040850
push 0x200
push esi
push 0x3a
push 0x1016cc60
call fcn.1003d430
add esp, 0x1c
xor esi, esi
cmp dword [0x100ca980], 0xffffffff
je 0x10021320
cmp esi, 0x200
jge 0x10021320
cmp dword [0x101434ac], 0
je 0x100212d8
push 0x10142448
push dword [esi*4 + 0x100ca980]
push str.g_tc_BlackList_Split_found___s_in_Apps__s__
push 0
call fcn.1003dfed
add esp, 0x10
mov edi, dword [esi*4 + 0x100ca980]
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100212e4
sub eax, ecx
cmp eax, 2
jbe 0x1002130a
cmp byte [edi], dl
je 0x1002130a
push edi
push 0x10142448
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10021701
cmp byte [esp + 0x17], 0
jne 0x10021701
inc esi
cmp dword [esi*4 + 0x100ca980], 0xffffffff
jne 0x100212ac
push 0x400
push 0x1016e068
push str.tc_Proc_OK
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10021345
mov byte [0x1016e068], 0
push 1
push str.tc_CUT_LOG_SEND_SERVER
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push ebp
call fcn.1003d897
push 0x5000
mov dword [0x10072cc8], eax
lea eax, [esp + 0xf64]
push eax
push str.tc_USBExpList
push ebx
push ebp
call fcn.1003e4ea
add esp, 0x24
cmp eax, 0xffffffff
jne 0x10021385
mov byte [esp + 0xf50], 0
push 0x1000
mov esi, 0x1016bc60
push esi
call fcn.100074a5
cmp byte [esp + 0xf58], 0
pop ecx
pop ecx
je 0x100213ca
lea eax, [esp + 0xf50]
push esi
push eax
call fcn.1003d5c8
cmp dword [0x101434ac], 0
pop ecx
pop ecx
je 0x100213ca
push esi
push str.g_tc_USBExpList___s_
push 0
call fcn.1003dfed
add esp, 0xc
xor esi, esi
cmp byte [0x10144693], 0
je 0x100213f4
push str._tc_Per_is_Personal_setting_on_public_
push esi
mov dword [0x101446ac], esi
mov dword [0x1014469c], esi
mov dword [0x10144698], esi
call fcn.1003dfed
pop ecx
pop ecx
cmp dword [0x10140300], 0x10000
mov byte [0x10072cb8], 0
jae 0x10021422
cmp dword [0x10144ed4], esi
jne 0x10021422
push 0x1b
push 0x102ca000
call fcn.100074a5
pop ecx
pop ecx
call sym.TC_AD.DLL_FDrv
call fcn.1002a1ac
mov ebp, 0x10142448
push ebp
call fcn.1002c849
test dword [0x101446a0], 0x80000000
pop ecx
mov byte [0x101400f5], al
mov ebx, 0x10140100
jne 0x100218a1
test dword [0x10144688], 0x1000000
je 0x10021471
cmp byte [0x10072497], 0
je 0x10021471
test al, al
je 0x1002175f
mov byte [0x10072497], 0
mov esi, 0x1005ce9d
mov edi, 0x1ff
test dword [0x10072cd0], 0x80000
je 0x100215d3
test dword [0x101446a0], 0x80000000
jne 0x100215d3
cmp byte [0x10072497], 0
je 0x100218ab
push 0x10143c88
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100215d3
cmp dword [0x10140300], 0x10000
jae 0x100215d3
cmp byte [0x10144ec0], al
jne 0x100215d3
cmp byte [0x101400f5], al
jne 0x100215d3
cmp byte [0x10140100], al
jne 0x1002157b
push edi
push eax
mov byte [esp + 0xaf4], al
lea eax, [esp + 0xaf5]
push eax
call fcn.10040850
push edi
lea eax, [esp + 0x879]
push 0
push eax
mov byte [esp + 0x880], 0
call fcn.10040850
push esi
push 0x1005e680
lea eax, [esp + 0x888]
push eax
push ebp
call fcn.1003cefb
push esi
push 0x1005f540
lea eax, [esp + 0xb1c]
push eax
lea eax, [esp + 0x89c]
push eax
call fcn.1003cefb
push esi
push 0x1005f800
lea eax, [esp + 0x8a8]
push eax
lea eax, [esp + 0xb30]
push eax
call fcn.1003cefb
add esp, 0x48
lea eax, [esp + 0x868]
push ebx
push eax
call fcn.10029a95
pop ecx
pop ecx
cmp dword [0x101434ac], 0
je 0x10021594
push ebx
push str.g_szSign_:__s
push 0
call fcn.1003dfed
add esp, 0xc
cmp byte [0x10140100], 0
je 0x100215ad
push str.ERR_
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100215d3
xor eax, eax
push eax
push eax
push eax
push str.TYPE_NOCERT
push 1
push closesocket
push 8
mov ecx, 0x10196498
call fcn.10036ad0
test eax, eax
je 0x100215d3
call fcn.1002965e
cmp byte [0x10072497], 0
je 0x100218ab
cmp dword [0x10140300], 0x10000
jae 0x100218ab
test dword [0x1013ee8c], 0x2000000
je 0x100218ab
cmp byte [0x10140100], 0
jne 0x100216a7
push edi
lea eax, [esp + 0xaf1]
push 0
push eax
mov byte [esp + 0xaf8], 0
call fcn.10040850
push edi
lea eax, [esp + 0x879]
push 0
push eax
mov byte [esp + 0x880], 0
call fcn.10040850
push esi
push 0x1005e680
lea eax, [esp + 0x888]
push eax
push ebp
call fcn.1003cefb
push esi
push 0x1005f540
lea eax, [esp + 0xb1c]
push eax
lea eax, [esp + 0x89c]
push eax
call fcn.1003cefb
push esi
push 0x1005f800
lea eax, [esp + 0x8a8]
push eax
lea eax, [esp + 0xb30]
push eax
call fcn.1003cefb
add esp, 0x48
lea eax, [esp + 0x868]
push ebx
push eax
call fcn.10029a95
cmp byte [0x10140100], 0
pop ecx
pop ecx
je 0x100218ab
push str.ERR_
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100218ab
push 0x100628a8
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100218ab
push str.RUNDLL32.EXE
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100218ab
push str.DLLHOST.EXE
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100218ab
mov byte [0x10072497], al
jmp 0x100218ab
cmp dword [0x101434ac], 0
je 0x10021725
push 0x10142448
push dword [esi*4 + 0x100ca980]
push str.SendInfoDisplayBlack_g_tc_BlackList_Split_found___s_in_Apps__s_
push 0
call fcn.1003dfed
add esp, 0x10
call fcn.1002d6c6
or byte [0x102bc549], al
push 1
push 0x10142448
call fcn.1000f3e6
pop ecx
pop ecx
test eax, eax
je 0x10021320
test dword [0x1015bd84], 0x80000000
je 0x10021757
call fcn.1002d5a9
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x10140100], 0
mov edi, 0x1ff
jne 0x10021805
push edi
lea eax, [esp + 0xaf1]
push 0
push eax
mov byte [esp + 0xaf8], 0
call fcn.10040850
push edi
lea eax, [esp + 0x879]
push 0
push eax
mov byte [esp + 0x880], 0
call fcn.10040850
mov esi, 0x1005ce9d
push esi
push 0x1005e680
lea eax, [esp + 0x888]
push eax
push ebp
call fcn.1003cefb
push esi
push 0x1005f540
lea eax, [esp + 0xb1c]
push eax
lea eax, [esp + 0x89c]
push eax
call fcn.1003cefb
push esi
push 0x1005f800
lea eax, [esp + 0x8a8]
push eax
lea eax, [esp + 0xb30]
push eax
call fcn.1003cefb
add esp, 0x48
lea eax, [esp + 0x868]
push ebx
push eax
call fcn.10029a95
pop ecx
pop ecx
jmp 0x1002180a
mov esi, 0x1005ce9d
push str.Microsoft
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002188e
push str.Bandisoft
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002188e
push 0x10062844
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002188e
push str.HANCOM
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002188e
push 0x10062834
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002188e
push str.ahnlab
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002188e
push str.hauri
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002188e
push 0x10062818
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002147b
mov byte [0x10072497], 0
mov byte [0x101400f5], 1
jmp 0x1002147b
mov esi, 0x1005ce9d
mov edi, 0x1ff
cmp dword [0x101434ac], 0
je 0x10021962
cmp byte [0x10140100], 0
jne 0x10021952
push edi
lea eax, [esp + 0xaf1]
push 0
push eax
mov byte [esp + 0xaf8], 0
call fcn.10040850
push edi
lea eax, [esp + 0x879]
push 0
push eax
mov byte [esp + 0x880], 0
call fcn.10040850
push esi
push 0x1005e680
lea eax, [esp + 0x888]
push eax
push ebp
call fcn.1003cefb
push esi
push 0x1005f540
lea eax, [esp + 0xb1c]
push eax
lea eax, [esp + 0x89c]
push eax
call fcn.1003cefb
push esi
push 0x1005f800
lea eax, [esp + 0x8a8]
push eax
lea eax, [esp + 0xb30]
push eax
call fcn.1003cefb
add esp, 0x48
lea eax, [esp + 0x868]
push ebx
push eax
call fcn.10029a95
pop ecx
pop ecx
push ebx
push str.g_szSign_:__s
push 0
call fcn.1003dfed
add esp, 0xc
test dword [0x10144688], 0x4000000
mov byte [0x1013dc03], 0
je 0x10021999
push 0x10142848
push str.EXPLORER.EXEIEXPLORE.EXECHROME.EXEWHALE.EXESWING.EXEOutLook.EXEALZIP.EXEBandiZip.EXEbreadzip.EXE7z.EXEALZIP.EXEWinRAR.EXEWinZip.EXEWLMAIL.EXEMSIMN.EXEMicrosoftEdge.EXEMicrosoftEdgeCP.EXEfirefox.EXEOPERA.EXESafari.EXEWebKit2WebProcess.EXEwscript.execscript.exeConhost.exeCMD.exePowerShell.exepowershell_ise.exeUCBrowser.exeSpark.exe
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10021999
cmp byte [0x10144ec0], 0
jne 0x10021999
mov byte [0x1013dc03], 1
test byte [0x101446a0], 0x10
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
jne 0x100219df
cmp dword [0x10140300], 0x10
jae 0x100219df
xor esi, esi
mov byte [0x1013ee5e], 0
cmp dword [0x1013eea8], esi
jne 0x100219f4
lea eax, [esp + 0x34]
push eax
push esi
push esi
push 0x1000d357
push esi
push esi
call fcn.10041127
add esp, 0x18
mov dword [0x1013eea8], eax
jmp 0x100219f4
mov eax, dword [0x1013eea8]
xor esi, esi
cmp eax, esi
je 0x100219f4
push esi
push eax
call edi
mov dword [0x1013eea8], esi
test dword [0x10144688], 0x40000000
jne 0x10021a25
cmp dword [0x1013eea4], esi
jne 0x10021a38
lea eax, [esp + 0x34]
push eax
push esi
push esi
push 0x1000ccb8
push esi
push esi
call fcn.10041127
add esp, 0x18
mov dword [0x1013eea4], eax
jmp 0x10021a38
mov eax, dword [0x1013eea4]
cmp eax, esi
je 0x10021a38
push esi
push eax
call edi
mov dword [0x1013eea4], esi
mov al, 1
mov ecx, dword [esp + 0x10350]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004083f
add esp, 0x10344
ret