Function at 0x1003c139
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x39a8]
mov eax, 0x3a28
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x39a4], eax
mov eax, ecx
push ebx
mov ebx, dword [ebp + 0x39bc]
mov dword [ebp - 0x6c], eax
add eax, 0x58
push esi
mov esi, dword [ebp + 0x39b8]
push eax
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x64], eax
call fcn.100154e5
pop ecx
test al, al
je 0x1003c189
xor eax, eax
jmp 0x1003ce2d
cmp dword [0x1015668c], 0
mov eax, dword [ebp + 0x39b4]
mov dword [ebp - 0x60], eax
je 0x1003c1ac
push ebx
push esi
push str.SendInfoDisplay_Subject__s_To__s_
push 0
call fcn.100412e2
add esp, 0x10
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c1b1
sub eax, edx
cmp eax, 0x2800
jbe 0x1003c1c7
mov byte [esi + 0x2800], cl
push 0x7c
push esi
jmp 0x1003c1d3
mov byte [eax], 0x20
push 0x7c
inc eax
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x1003c1cc
mov eax, dword [ebp + 0x39b0]
push edi
mov edi, 0x10181de0
mov ecx, 0x200
test dword [0x1015787c], eax
je 0x1003c458
test dword [0x1016ef6c], ecx
je 0x1003c22d
cmp byte [0x1016fd70], 0
je 0x1003c22d
cmp byte [0x10095eb0], 0
je 0x1003c22d
push 0x10095eb0
push 0x1016fd70
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003c4cf
test dword [ebp + 0x39b0], 0x10000000
mov eax, dword [0x1015668c]
je 0x1003c42e
cmp eax, 0x11
je 0x1003c24c
cmp eax, 0x17
jne 0x1003c25a
push str.start
push 0
call fcn.100412e2
pop ecx
pop ecx
cmp byte [esi], 0
je 0x1003ca5f
lea eax, [ebp + 0x31a4]
push eax
push esi
call fcn.10037e38
mov eax, dword [0x1015668c]
pop ecx
pop ecx
push 0x11
pop ebx
cmp eax, ebx
je 0x1003c283
cmp eax, 0x17
jne 0x1003c29f
push 0x1016ff70
lea eax, [ebp + 0x31a4]
push eax
push esi
push str.Subject__s_MyURL__s_g_tc_OKURL__s_
push 0
call fcn.100412e2
add esp, 0x14
cmp byte [0x10181de0], 0
je 0x1003c2c3
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003c2c3
lea eax, [ebp + 0x31a4]
push edi
push eax
call fcn.1000789a
pop ecx
pop ecx
cmp byte [ebp + 0x31a4], 0
je 0x1003c2ed
lea eax, [ebp + 0x31a4]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003c2ed
mov eax, dword [0x10181ddc]
mov dword [0x10181e44], eax
jmp 0x1003ca5f
mov eax, dword [0x1016ef6c]
xor esi, esi
test eax, 0x10000
je 0x1003c371
cmp byte [0x10181de0], 0
je 0x1003c371
cmp byte [ebp + 0x31a4], 0
je 0x1003c344
cmp dword [0x1017b770], esi
je 0x1003c344
cmp esi, 0x400
jge 0x1003c344
push dword [esi*4 + 0x1017b770]
lea eax, [ebp + 0x31a4]
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1003c4cf
inc esi
cmp dword [esi*4 + 0x1017b770], eax
jne 0x1003c315
mov eax, dword [0x1015668c]
mov dword [ebp - 0x60], ebx
cmp eax, ebx
je 0x1003c359
cmp eax, 0x17
jne 0x1003c4cf
push dword [esi*4 + 0x1017b770]
lea eax, [ebp + 0x31a4]
push eax
push str.TC_DT_OKURLISOK__s___s_
jmp 0x1003c3fa
test eax, 0x20000
je 0x1003c3fe
cmp byte [0x10181de0], 0
je 0x1003c3fe
cmp byte [ebp + 0x31a4], 0
je 0x1003c4cf
cmp dword [0x1017b770], esi
je 0x1003c4cf
cmp esi, 0x400
jge 0x1003c4cf
push dword [esi*4 + 0x1017b770]
lea eax, [ebp + 0x31a4]
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x1003c3d2
inc esi
cmp dword [esi*4 + 0x1017b770], eax
jne 0x1003c39e
jmp 0x1003c4cf
mov eax, dword [0x1015668c]
mov dword [ebp - 0x60], ebx
cmp eax, ebx
je 0x1003c3e7
cmp eax, 0x17
jne 0x1003c4cf
push dword [esi*4 + 0x1017b770]
lea eax, [ebp + 0x31a4]
push eax
push str.TC_DT_OKURLISBLACK__s___s_
push 0
jmp 0x1003c421
mov eax, dword [0x1015668c]
mov dword [ebp - 0x60], ebx
cmp eax, ebx
je 0x1003c413
cmp eax, 0x17
jne 0x1003c4cf
push edi
lea eax, [ebp + 0x31a4]
push eax
push str.MediaType__TYPE_INTERNETURL_ELSE__s___s_
push esi
call fcn.100412e2
add esp, 0x10
jmp 0x1003c4cf
push 0x11
pop ecx
mov dword [ebp - 0x60], ecx
cmp eax, ecx
je 0x1003c441
cmp eax, 0x17
jne 0x1003c4cf
push dword [ebp + 0x39b0]
push str.MediaType__d_
push 0
call fcn.100412e2
add esp, 0xc
jmp 0x1003c4cf
mov eax, dword [0x101580e0]
shl eax, 0xa
cmp eax, dword [ebp + 0x39c0]
ja 0x1003c4cf
mov eax, dword [0x1016ef6c]
test eax, 0x40000
je 0x1003c4cf
mov esi, 0x10095eb0
test ecx, eax
je 0x1003c49f
cmp byte [0x1016fd70], 0
je 0x1003c49f
cmp byte [0x10095eb0], 0
je 0x1003c49f
push esi
push 0x1016fd70
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003c4cf
cmp dword [0x1015668c], 0x11
mov dword [ebp - 0x60], 0x21
jne 0x1003c4cf
mov eax, dword [0x101580d4]
push ebx
push esi
push dword [ebp + 0x39c0]
shl eax, 0xa
push eax
push str.SEND_CUTDEVICESIZE12__08x____08x_host:_s_file:_s
push 0
call fcn.100412e2
add esp, 0x18
mov ecx, dword [ebp - 0x6c]
call fcn.1003a66e
cmp dword [0x1015668c], 0x14
mov edi, 0x400000
jne 0x1003c4fb
cmp dword [ebp + 0x39b0], edi
jne 0x1003c4fb
push str.SendInfoDisplay_2
push 0
call fcn.100412e2
pop ecx
pop ecx
cmp dword [0x10157874], 2
push 0x42
pop esi
jne 0x1003c510
test byte [ebp - 0x60], 1
je 0x1003c536
mov dword [ebp - 0x60], esi
test byte [ebp - 0x60], 1
je 0x1003c536
cmp byte [0x1015cb48], 0
je 0x1003c536
push 0x10155a28
push 0x1015cb48
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003c536
mov dword [ebp - 0x60], esi
mov ebx, dword [ebp - 0x60]
and ebx, 1
mov dword [ebp - 0x70], ebx
je 0x1003c559
mov eax, dword [ebp - 0x6c]
mov byte [eax + 0x50bc], 1
mov byte [eax + 0x1470], 1
mov byte [eax + 0x630c], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp + 0x39b0], edi
jne 0x1003c5a8
cmp dword [0x102b5a4c], 0
jne 0x1003c57c
call esi
mov dword [0x102b5a4c], eax
jmp 0x1003ca5f
call esi
mov ecx, dword [0x102b5a4c]
add ecx, 0x7d0
cmp ecx, eax
jbe 0x1003c5a1
call esi
mov dword [0x102b5a4c], eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x1003ce2c
call esi
mov dword [0x102b5a4c], eax
push dword [ebp - 0x74]
push dword [ebp - 0x68]
call fcn.10010a92
pop ecx
pop ecx
test eax, eax
je 0x1003c5c0
mov eax, ebx
jmp 0x1003ce2c
mov esi, 0x1ff
push esi
xor ebx, ebx
lea eax, [ebp + 0x2da5]
push ebx
push eax
mov byte [ebp + 0x2da4], 0
call fcn.10045030
lea eax, [ebp + 0x2da4]
push 0x200
push eax
call fcn.10007867
mov eax, dword [0x1015185c]
add eax, 0xea60
push eax
mov edi, 0x10061188
lea eax, [ebp + 0x2da4]
push edi
push eax
call fcn.10045378
push esi
lea eax, [ebp + 0x2fa5]
push ebx
push eax
mov byte [ebp + 0x2fa4], bl
call fcn.10045030
push esi
lea eax, [ebp + 0x37a5]
push ebx
push eax
mov byte [ebp + 0x37a4], bl
call fcn.10045030
push esi
lea eax, [ebp + 0x2ba5]
push ebx
push eax
mov byte [ebp + 0x2ba4], bl
call fcn.10045030
add esp, 0x44
push 0x2bff
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], bl
call fcn.10045030
mov eax, dword [0x102b5a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x2fa4]
push str.SoftWareTrojanCut_tc_FileM
push eax
mov ebx, edx
add ebx, 0x64
inc dword [0x102b5a40]
mov dword [ebp - 0x78], ebx
call fcn.10045378
push ebx
lea eax, [ebp + 0x2ba4]
push edi
push eax
call fcn.10045378
push 0x200
lea eax, [ebp + 0x37a4]
push 0
push eax
call fcn.10045030
lea eax, [ebp + 0x37a4]
push eax
call fcn.10040f13
lea eax, [ebp + 0x37a4]
push eax
call fcn.10038534
add esp, 0x34
cmp dword [0x1015668c], 0
je 0x1003c6e2
lea eax, [ebp + 0x37a4]
push eax
push str.SendInfoDisplay_sProcess__s_
push 0
call fcn.100412e2
add esp, 0xc
push esi
lea eax, [ebp + 0x35a5]
push 0
push eax
mov byte [ebp + 0x35a4], 0
call fcn.10045030
lea eax, [ebp - 0x80]
push eax
call fcn.100457db
lea eax, [ebp - 0x80]
push eax
call fcn.100457b4
add esp, 0x14
test eax, eax
je 0x1003c72e
push eax
push str._Y__m__d__H:_M:_S
mov edi, 0x200
lea eax, [ebp + 0x35a4]
push edi
push eax
call fcn.10046465
add esp, 0x10
jmp 0x1003c746
lea eax, [ebp + 0x35a4]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
mov edi, 0x200
push esi
lea eax, [ebp + 0x33a5]
push 0
push eax
mov byte [ebp + 0x33a4], 0
call fcn.10045030
mov ebx, dword [ebp + 0x39b0]
add esp, 0xc
test ebx, 0x10000
je 0x1003c863
mov esi, 0x10070258
lea edi, [ebp + 0x33a4]
movsd dword es:[edi], dword [esi]
push 0x2a00
movsw word es:[edi], word [esi]
call fcn.10045413
and dword [ebp - 0x64], 0
mov ebx, eax
mov eax, dword [ebp - 0x68]
pop ecx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003c796
sub eax, ecx
je 0x1003c7ce
mov edi, dword [ebp - 0x68]
mov ecx, ebx
sub edi, ebx
mov al, byte [edi + ecx]
cmp al, 0x7c
jne 0x1003c7b4
mov byte [ecx], 0x20
jmp 0x1003c7b6
mov byte [ecx], al
mov eax, dword [ebp - 0x68]
inc dword [ebp - 0x64]
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003c7c0
sub eax, esi
cmp dword [ebp - 0x64], eax
jb 0x1003c7a8
mov eax, dword [ebp + 0x39b0]
or eax, 0x800
test byte [0x10151868], 1
je 0x1003c81d
push 0x1014e918
push dword [ebp + 0x39c0]
push eax
push dword [ebp - 0x74]
lea eax, [ebp + 0x33a4]
push ebx
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
lea eax, [ebp - 0x5c]
push str._s_d_s__s__s__s_d_d_s
push eax
call fcn.10045378
add esp, 0x2c
jmp 0x1003c851
push dword [ebp + 0x39c0]
push eax
push dword [ebp - 0x74]
lea eax, [ebp + 0x33a4]
push ebx
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
lea eax, [ebp - 0x5c]
push str._s_d_s__s__s__s_d_d
push eax
call fcn.10045378
add esp, 0x28
push ebx
call fcn.1004536d
mov ebx, dword [ebp + 0x39b0]
pop ecx
jmp 0x1003cbcf
test ebx, 0x2000000
je 0x1003c8e8
push edi
lea eax, [ebp + 0x33a4]
push eax
push 0x77
push dword [0x102d3d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
mov eax, ebx
or eax, 0x800
test byte [0x10151868], 1
je 0x1003c8bf
push 0x1014e918
push eax
push dword [ebp - 0x74]
lea eax, [ebp + 0x33a4]
push dword [ebp - 0x68]
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
push str._s_d_s__s__s__s_d_s
jmp 0x1003cb94
push eax
push dword [ebp - 0x74]
lea eax, [ebp + 0x33a4]
push dword [ebp - 0x68]
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
push str._s_d_s__s__s__s_d
jmp 0x1003cbc3
test ebx, 0x10000000
je 0x1003ca74
test dword [0x1015787c], ebx
je 0x1003c915
test byte [ebp - 0x60], 2
je 0x1003c915
test byte [ebp - 0x60], 0x40
jne 0x1003c915
test byte [0x1015186c], 0x10
je 0x1003ca5f
mov esi, dword [ebp - 0x68]
mov al, byte [esi + 1]
cmp al, 0x3a
jne 0x1003c929
cmp byte [esi + 2], 0x5c
je 0x1003ca5f
cmp byte [esi], 0x5c
jne 0x1003c936
cmp al, 0x5c
je 0x1003ca5f
push str.about:blank
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
jne 0x1003ca5f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c94f
sub eax, edx
cmp eax, 4
jbe 0x1003c984
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c962
sub eax, edx
cmp byte [eax + esi - 2], 0x20
jne 0x1003c984
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c977
sub eax, edx
mov byte [eax + esi - 2], cl
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.http:__
push esi
call edi
test eax, eax
je 0x1003c99b
lea eax, [esi + 7]
jmp 0x1003c9ac
push str.https:__
push esi
call edi
test eax, eax
lea eax, [esi + 8]
jne 0x1003c9ac
mov eax, esi
test byte [0x10151868], 1
je 0x1003c9eb
push 0x1014e918
mov ecx, ebx
or ecx, 0x800
push ecx
push dword [ebp - 0x74]
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
lea eax, [ebp - 0x5c]
push str._s_d_s_URL__s_s_d_s
push eax
call fcn.10045378
add esp, 0x24
jmp 0x1003ca47
mov ecx, dword [ebp - 0x74]
test ecx, ecx
je 0x1003ca1a
cmp byte [ecx], 0x2d
je 0x1003ca1a
mov edx, ebx
or edx, 0x800
push edx
push ecx
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
push str._s_d_s_Paste__s_s_d
jmp 0x1003ca3b
mov edx, ebx
or edx, 0x800
push edx
push ecx
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
push str._s_d_s_URL__s_s_d
lea eax, [ebp - 0x5c]
push eax
call fcn.10045378
add esp, 0x20
push esi
mov edi, 0x102b55c8
push edi
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1003ca66
test byte [ebp - 0x60], 0x10
jne 0x1003ca66
xor eax, eax
jmp 0x1003ce2c
push esi
push edi
call fcn.1000789a
pop ecx
pop ecx
jmp 0x1003cbcf
mov eax, 0x8000000
test eax, ebx
je 0x1003cade
cmp dword [ebp - 0x70], 0
je 0x1003ca92
test dword [0x1016ef68], eax
je 0x1003ca92
mov dword [ebp - 0x60], 0x42
push edi
lea eax, [ebp + 0x33a4]
push eax
push 0x78
jmp 0x1003caf0
push 0x1014e918
push dword [eax + 0x8b2c]
lea eax, [ebp + 0x33a4]
push ebx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
lea eax, [ebp - 0x5c]
push str._s_d_s__s__s_s_d_d_s
push eax
call fcn.10045378
add esp, 0x2c
jmp 0x1003cbcf
test bl, 2
je 0x1003cb34
push edi
lea eax, [ebp + 0x33a4]
push eax
push 0x8b
push dword [0x102d3d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
test byte [0x10151868], 1
mov eax, dword [ebp - 0x6c]
jne 0x1003ca9e
push dword [eax + 0x8b2c]
lea eax, [ebp + 0x33a4]
push ebx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push eax
lea eax, [ebp + 0x37a4]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
push str._s_d_s__s__s_s_d_d
jmp 0x1003cb94
test ebx, 0x400000
je 0x1003cbcf
mov esi, dword [ebp - 0x68]
test esi, esi
je 0x1003cb62
cmp byte [esi], 0
je 0x1003cb62
lea edx, [ebp + 0x37a4]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1003cb56
mov byte [esi], cl
test byte [0x10151868], 1
mov eax, dword [ebp - 0x6c]
je 0x1003cba2
push 0x1014e918
push dword [eax + 0x8b2c]
lea eax, [ebp + 0x37a4]
push ebx
push dword [ebp - 0x64]
push esi
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
push str._s_d_s_ScreenShot__s_s_d_d_s
lea eax, [ebp - 0x5c]
push eax
call fcn.10045378
add esp, 0x28
jmp 0x1003cbcf
push dword [eax + 0x8b2c]
lea eax, [ebp + 0x37a4]
push ebx
push dword [ebp - 0x64]
push esi
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x35a4]
push eax
push str._s_d_s_ScreenShot__s_s_d_d
lea eax, [ebp - 0x5c]
push eax
call fcn.10045378
add esp, 0x24
cmp dword [0x1015668c], 0x14
jne 0x1003cbf3
cmp ebx, 0x400000
jne 0x1003cbfc
lea eax, [ebp - 0x5c]
push eax
push str.SendInfoDisplay_3__s_
push 0
call fcn.100412e2
add esp, 0xc
cmp dword [0x1015668c], 0
je 0x1003cc0f
lea eax, [ebp - 0x5c]
push eax
push str.SendInfoDisplay_subject:__s
push 0
call fcn.100412e2
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x2ba4]
push eax
lea eax, [ebp + 0x2fa4]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.100422d1
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.10041a19
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
add esp, 0x10
mov ebx, 0x100610e0
push ebx
push 0
call edi
mov dword [ebp - 0x64], eax
test eax, eax
jne 0x1003cc86
push ebx
push eax
call edi
mov dword [ebp - 0x64], eax
test eax, eax
jne 0x1003cc86
push eax
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push esi
call fcn.10040ccf
add esp, 0x10
mov dword [ebp - 0x64], eax
test eax, eax
je 0x1003cc9a
push dword [ebp - 0x60]
push dword [ebp - 0x78]
push 0xcfd
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x70], ecx
and dword [ebp - 0x70], 1
mov byte [0x102b5a44], 0
je 0x1003ce29
mov eax, dword [ebp + 0x39b0]
test eax, 0x400000
je 0x1003ccda
push ecx
push dword [ebp - 0x78]
push 0xcfd
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.1003a602
jmp 0x1003ce29
test dword [0x1015787c], eax
je 0x1003ce29
test eax, 0x10000000
je 0x1003ce29
push ecx
push dword [ebp - 0x78]
push 0xcfd
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x1015668c], 0
je 0x1003cd20
push 0x10181de0
push str.g_tc_RedirectURL___s_
push 0
call fcn.100412e2
add esp, 0xc
cmp byte [0x10181de0], 0
je 0x1003cdf5
push 0x2e
push 0x10181de0
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x1003cd7e
cmp dword [0x1015668c], eax
je 0x1003cd54
push str.MessageBox_ExitProcess
push eax
call fcn.100412e2
pop ecx
pop ecx
push 0x10155a28
push str.BrowserBlock_Pro
mov edi, str.SOFTWARETrojanCut_tc_Env
push edi
push esi
call fcn.100422d1
push dword [ebp - 0x68]
push str.BrowserBlock_URL
push edi
push esi
call fcn.100422d1
add esp, 0x20
jmp 0x1003cdf5
cmp byte [0x10181de0], 0
je 0x1003cdf5
cmp dword [0x1015668c], 0
je 0x1003cd9e
push str.g_tc_RedirectURL_gogo
push 0
call fcn.100412e2
pop ecx
pop ecx
push 0x10155228
push 0x1007006c
push str.SoftWareTrojanCut_tc_FileNa
push esi
call fcn.100422d1
add esp, 0x10
push ebx
push 0
call edi
test eax, eax
jne 0x1003cddf
push ebx
push eax
call edi
test eax, eax
jne 0x1003cddf
push eax
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push esi
call fcn.10040ccf
add esp, 0x10
test eax, eax
je 0x1003cdf5
push 0
push dword [0x101580ac]
push 0xcfe
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x101580ac], 2
jne 0x1003ce06
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1003a602
cmp dword [0x1015668c], 0x11
jne 0x1003ce22
push str.g_bRedirectURL_true
push 0
call fcn.100412e2
pop ecx
pop ecx
mov byte [0x102b5a44], 1
mov eax, dword [ebp - 0x70]
pop edi
mov ecx, dword [ebp + 0x39a4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x39a8
leave
ret 0x14