Function at 0x10039084
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x6944]
mov eax, 0x69c4
call fcn.10044f70
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x6940], eax
mov eax, dword [ebp + 0x6958]
push ebx
push esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x6960]
push edi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x6964]
mov dword [ebp - 0x64], ecx
mov ebx, 0x10154628
push 0x18
mov dword [ebp - 0x70], eax
mov edi, str.bitlockerwizardelev.exe
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov byte [ebp - 0x55], 0
mov edx, 0x8000000
je 0x10039493
mov ecx, dword [0x1015086c]
cmp byte [0x10150897], al
je 0x10039106
test edx, ecx
je 0x10039526
mov byte [ebp - 0x55], 1
cmp byte [0x102d2d91], al
jne 0x10039126
cmp dword [0x100774a8], 0x1f2e3d4c
jne 0x10039126
test edx, ecx
je 0x10039526
mov byte [ebp - 0x55], 1
cmp byte [0x10077497], al
jne 0x1003913a
test edx, ecx
je 0x10039526
mov byte [ebp - 0x55], 1
cmp dword [0x101570c4], eax
je 0x1003914e
test edx, ecx
je 0x10039526
mov byte [ebp - 0x55], 1
cmp dword [0x101570c8], eax
je 0x10039164
and dword [0x101570c8], eax
cmp byte [0x102d2d91], al
je 0x1003918e
cmp byte [ebp - 0x55], al
jne 0x1003919a
test dword [0x1015686c], 0x2000000
je 0x1003919a
mov eax, dword [0x102b4a3c]
cmp eax, 5
je 0x1003918e
cmp eax, 7
je 0x1003918e
cmp eax, 8
je 0x1003918e
cmp eax, 6
jne 0x1003919a
test edx, ecx
je 0x10039526
mov byte [ebp - 0x55], 1
mov edi, dword [ebp - 0x60]
push 0x7c
push edi
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
je 0x100391ae
mov byte [eax], 0
push 0x1006f870
push edi
call esi
test eax, eax
jne 0x10039526
push 0x1006b4c4
push ebx
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x100391df
push str.programdata
push edi
call esi
test eax, eax
jne 0x10039526
test dword [ebp + 0x694c], 0x100
je 0x1003922e
cmp dword [0x102bed64], 0
jne 0x1003922e
test dword [0x101570d8], 0x40000
jne 0x1003922e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub esi, dword [0x101570cc]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x101570c4]
mov ecx, 0x2710
test eax, eax
je 0x100394de
cmp esi, ecx
jb 0x100394ea
cmp byte [ebp - 0x55], 0
jne 0x10039493
push str.IE_Exploit_Magniber_RansomWare
push edi
call fcn.1004c1f9
pop ecx
pop ecx
test eax, eax
jne 0x10039493
mov ebx, 0x1400
push ebx
xor edi, edi
lea eax, [ebp + 0x3b34]
push edi
push eax
call fcn.10044b80
mov esi, 0x200
push esi
lea eax, [ebp + 0x6538]
push edi
push eax
call fcn.10044b80
push esi
lea eax, [ebp + 0x5538]
push edi
push eax
call fcn.10044b80
push esi
lea eax, [ebp + 0x6138]
push edi
push eax
call fcn.10044b80
push ebx
lea eax, [ebp + 0x3b34]
push eax
mov ebx, str.tc_ExOKURL
push ebx
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
call fcn.1004171d
add esp, 0x44
cmp eax, 0xffffffff
jne 0x100392bd
mov byte [ebp + 0x3b34], 0
push esi
lea eax, [ebp + 0x6538]
push edi
push eax
call fcn.10044b80
add esp, 0xc
cmp byte [0x10150cd0], 0
je 0x10039320
xor eax, eax
mov cl, byte [eax + 0x10150cd0]
mov byte [ebp + eax + 0x6538], cl
inc eax
test cl, cl
jne 0x100392d9
lea eax, [ebp + 0x6538]
push 0x2f
push eax
call fcn.10044a60
pop ecx
pop ecx
cmp eax, edi
je 0x10039320
inc eax
push 0x2f
push eax
call fcn.10044a60
pop ecx
pop ecx
cmp eax, edi
je 0x10039320
inc eax
push 0x2f
push eax
call fcn.10044a60
pop ecx
pop ecx
cmp eax, edi
je 0x10039320
mov byte [eax], 0
cmp byte [ebp + 0x3b34], 0
je 0x1003935f
cmp byte [ebp + 0x6538], 0
je 0x1003935f
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x3b34]
push eax
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1003935f
test dword [0x1015086c], 0x8000000
je 0x10039526
mov byte [ebp - 0x55], 1
push esi
lea eax, [ebp + 0x5538]
push eax
push 0x90
push dword [0x102d2d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x5538]
push eax
lea eax, [ebp + 0x6138]
push eax
call fcn.10044ec8
add esp, 0xc
cmp byte [ebp - 0x55], 0
jne 0x10039493
push 4
push str.Warning
lea eax, [ebp + 0x6138]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x10039493
push 0x1400
lea eax, [ebp + 0x3b34]
push eax
push ebx
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100393e9
mov byte [ebp + 0x3b34], 0
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x3b34]
push eax
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10039462
lea edi, [ebp + 0x3b34]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10039409
mov esi, 0x10065864
lea eax, [ebp + 0x6538]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10039420
lea edi, [ebp + 0x3b34]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10039430
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp + 0x3b34]
push eax
push ebx
and ecx, 3
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
rep movsb byte es:[edi], byte [esi]
call fcn.10042219
add esp, 0x10
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x3b34]
push eax
push str.found_IE_Exploit_Magniber_RansomWare_ExceptURL__s_url__s_
push 0
call fcn.1004122a
add esp, 0x10
test dword [0x1015086c], 0x8000000
je 0x10039526
mov byte [ebp - 0x55], 1
mov eax, dword [ebp + 0x6954]
or eax, 0x400
mov dword [ebp - 0x5c], eax
mov eax, dword [0x1015568c]
mov ebx, 0x88
cmp eax, ebx
je 0x100394b9
cmp eax, 0x44
je 0x100394b9
cmp eax, 4
jne 0x1003952d
mov esi, dword [ebp - 0x60]
push esi
push dword [0x1015687c]
xor edi, edi
push dword [ebp - 0x5c]
push dword [ebp + 0x6950]
push str.SendInfoDisplayRansom_0__08x__08x__08x__s
push edi
call fcn.1004122a
add esp, 0x18
jmp 0x10039532
cmp esi, 0x7d0
jae 0x1003922e
test eax, eax
je 0x100394fa
sub dword [0x101570cc], 0xbb8
jmp 0x10039500
sub dword [0x101570cc], ecx
mov eax, dword [0x1015568c]
cmp eax, 0x88
je 0x10039516
cmp eax, 0x44
je 0x10039516
cmp eax, 4
jne 0x10039526
push esi
push str.SendInfoDisplayRansom_cancel__d_
push 0
call fcn.1004122a
add esp, 0xc
xor eax, eax
jmp 0x1003a0ec
mov esi, dword [ebp - 0x60]
xor edi, edi
cmp byte [ebp - 0x55], 0
jne 0x10039571
test byte [ebp + 0x6954], 1
jne 0x10039571
push 0x1006b128
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10039571
push 0x100639dc
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10039571
test dword [0x1015086c], 0x8000000
je 0x10039526
mov byte [ebp - 0x55], 1
mov eax, dword [0x1015568c]
cmp eax, ebx
je 0x1003957f
cmp eax, 0x44
jne 0x1003959d
push esi
push dword [0x1015687c]
push dword [ebp - 0x5c]
push dword [ebp + 0x6950]
push str.SendInfoDisplayRansom_1__08x__08x__08x__s
push edi
call fcn.1004122a
add esp, 0x18
push 0x10063cf8
push esi
mov dword [ebp - 0x6c], esi
call fcn.10044fa0
pop ecx
pop ecx
cmp esi, eax
jne 0x100395b7
add esi, 4
mov dword [ebp - 0x6c], esi
cmp byte [ebp - 0x55], 0
mov esi, 0x20000000
jne 0x100395fe
cmp byte [0x10153969], 0
jne 0x10039607
test dword [0x101570d8], esi
je 0x1003961f
push 0x10154228
call fcn.1001d96c
mov byte [0x10153969], al
mov eax, dword [0x1015568c]
pop ecx
cmp eax, ebx
je 0x100395f1
cmp eax, 0x44
jne 0x100395fe
push str.SendInfoDisplayRansom_g_bSetUpExe_chk
push edi
call fcn.1004122a
pop ecx
pop ecx
cmp byte [0x10153969], 0
je 0x1003961f
mov eax, dword [0x1015086c]
test esi, eax
jne 0x1003961f
test eax, 0x8000000
je 0x10039526
mov byte [ebp - 0x55], 1
test dword [0x10077cc8], 0x100000
je 0x10039663
push edi
push str.tc_NO_CON_RANSOM_NO_CUT
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
call fcn.10040c17
mov dword [0x102b45c4], eax
mov eax, dword [0x1015568c]
add esp, 0x10
cmp eax, ebx
je 0x10039656
cmp eax, 0x44
jne 0x10039663
push str.SendInfoDisplayRansom_g_tc_NO_CON_RANSOM_NO_CUT
push edi
call fcn.1004122a
pop ecx
pop ecx
test dword [0x10150864], 0x400
jne 0x10039678
cmp dword [0x10156874], 2
jne 0x100396a8
mov eax, dword [0x1015568c]
or dword [0x10150cb0], 0x10
mov dword [ebp - 0x5c], 0x42
mov byte [0x10077497], 0
cmp eax, ebx
je 0x1003969b
cmp eax, 0x44
jne 0x100396a8
push str.SendInfoDisplayRansom_TC_OPTION1_RANSOM_COM
push edi
call fcn.1004122a
pop ecx
pop ecx
cmp dword [0x102b45c4], edi
jne 0x100396dc
cmp byte [0x10153969], 0
jne 0x100396dc
cmp byte [ebp - 0x55], 0
jne 0x100396dc
cmp byte [0x1015bb48], 0
je 0x100396fe
push 0x10154a28
push 0x1015bb48
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100396fe
mov eax, dword [0x1015568c]
mov dword [ebp - 0x5c], 0x40042
cmp eax, ebx
je 0x100396f1
cmp eax, 0x44
jne 0x100396fe
push str.SendInfoDisplayRansom_bShowDetect_OK
push edi
call fcn.1004122a
pop ecx
pop ecx
push 0x18
mov edi, str.bitlockerwizardelev.exe
mov esi, 0x10154628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x10039755
mov eax, dword [0x1015568c]
cmp eax, ebx
je 0x1003971f
cmp eax, 0x44
jne 0x10039740
push dword [ebp - 0x60]
push dword [0x1015687c]
push dword [ebp - 0x5c]
push dword [ebp + 0x6950]
push str.SendInfoDisplayRansom_bitlockerwizardelev__08x__08x__08x__s
push 0
call fcn.1004122a
add esp, 0x18
mov eax, dword [0x10150868]
and eax, 0x400000
neg eax
sbb eax, eax
and eax, 0x41
inc eax
mov dword [ebp - 0x5c], eax
or dword [ebp - 0x5c], 0x400
test byte [ebp - 0x5c], 0x40
je 0x1003978d
cmp dword [0x102b45b4], 0
je 0x10039782
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x102b45b4]
cmp eax, 0x5265c00
jbe 0x10039526
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102b45b4], eax
push dword [ebp - 0x6c]
call fcn.10010839
pop ecx
test eax, eax
je 0x100397b7
mov esi, dword [ebp - 0x5c]
and esi, 1
je 0x100397b0
test byte [ebp + 0x694c], 4
je 0x100397b0
call fcn.1002c8b0
mov eax, esi
jmp 0x1003a0ec
mov ebx, 0x200
push ebx
xor edi, edi
lea eax, [ebp + 0x5338]
push edi
push eax
call fcn.10044b80
mov eax, dword [0x1015085c]
add eax, 0xea60
push eax
mov esi, 0x10061178
lea eax, [ebp + 0x5338]
push esi
push eax
call fcn.10044ec8
push ebx
lea eax, [ebp + 0x5738]
push edi
push eax
call fcn.10044b80
push ebx
lea eax, [ebp + 0x6738]
push edi
push eax
call fcn.10044b80
push ebx
lea eax, [ebp + 0x5938]
push edi
push eax
call fcn.10044b80
push 0x1388
lea eax, [ebp + 0x13ac]
push edi
push eax
call fcn.10044b80
add esp, 0x48
push 0x1400
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.10044b80
push 0x1400
lea eax, [ebp + 0x2734]
push edi
push eax
call fcn.10044b80
mov eax, dword [0x102b4a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x5738]
push str.SoftWare_trueEP_tc_Files
push eax
mov edi, edx
add edi, 0x64
inc dword [0x102b4a40]
mov dword [ebp - 0x74], edi
call fcn.10044ec8
push edi
lea eax, [ebp + 0x5938]
push esi
push eax
call fcn.10044ec8
lea eax, [ebp + 0x6738]
push eax
call fcn.10040e5b
lea eax, [ebp + 0x6738]
push eax
call fcn.1003839d
push ebx
xor esi, esi
lea eax, [ebp + 0x6338]
push esi
push eax
call fcn.10044b80
add esp, 0x40
lea eax, [ebp - 0x80]
push eax
call fcn.1004532b
lea eax, [ebp - 0x80]
push eax
call fcn.10045304
pop ecx
pop ecx
cmp eax, esi
je 0x100398de
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x6338]
push ebx
push eax
call fcn.10045fb5
add esp, 0x10
jmp 0x100398f1
lea eax, [ebp + 0x6338]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
push 0x401
lea eax, [ebp + 0x4f34]
push esi
push eax
call fcn.10044b80
add esp, 0xc
test dword [0x10077cc0], 0x2000
je 0x1003992a
cmp dword [ebp - 0x68], esi
je 0x1003992a
push ebx
lea eax, [ebp + 0x4f34]
push eax
push dword [ebp - 0x68]
call fcn.100408a7
add esp, 0xc
xor eax, eax
lea edi, [ebp + 0x6938]
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x694c]
test al, 8
je 0x10039945
mov esi, str.L__
jmp 0x10039983
test eax, 0x100
je 0x10039953
mov esi, str.O__
jmp 0x10039983
test ebx, eax
je 0x1003995e
mov esi, str.D__
jmp 0x10039983
test al, 4
je 0x10039969
mov esi, str.B__
jmp 0x10039983
test eax, 0x1000
je 0x10039977
mov esi, str.F__
jmp 0x10039983
test eax, 0x2000
je 0x1003998b
mov esi, str.K__
lea edi, [ebp + 0x6938]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x5c]
and eax, 1
mov dword [ebp - 0x60], eax
je 0x10039c00
test byte [0x10077cc8], 2
je 0x10039c00
mov esi, 0x1400
push esi
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.10044b80
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.1003372f
mov eax, dword [0x1015568c]
mov esi, 0x88
add esp, 0x14
cmp eax, esi
je 0x100399d8
cmp eax, 0x44
jne 0x100399e6
push str.GetDLLStacks_end
push 0
call fcn.1004122a
pop ecx
pop ecx
cmp byte [ebp - 0x54], 0
je 0x10039a1b
cmp dword [0x102b4a3c], 7
jne 0x10039a1b
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.createsoftwareinventory
lea eax, [ebp - 0x54]
push eax
call edi
test eax, eax
je 0x10039a21
test dword [0x1015086c], 0x8000000
jne 0x10039a21
jmp 0x10039526
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov eax, dword [0x1015568c]
cmp eax, esi
je 0x10039a2f
cmp eax, 0x44
jne 0x10039a3d
push str.SendInfoDisplayRansom_disp_6
push 0
call fcn.1004122a
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x6538]
push 0
push eax
call fcn.10044b80
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x6738]
push eax
call fcn.10040d71
mov eax, dword [0x1015568c]
add esp, 0x14
cmp eax, esi
je 0x10039a70
cmp eax, 0x44
jne 0x10039a7e
push str.SendInfoDisplayRansom_disp_66
push 0
call fcn.1004122a
pop ecx
pop ecx
cmp byte [0x102b4630], 0
je 0x10039a9b
xor eax, eax
mov cl, byte [eax + 0x102b4630]
mov byte [ebp + eax + 0x6738], cl
inc eax
test cl, cl
jne 0x10039a89
push str.rundll32.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039b23
push str.dllhost.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039b23
push str.svchost.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039b23
push str.msiexec.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039b23
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x6738]
push eax
call fcn.1000770a
pop ecx
push eax
lea eax, [ebp + 0x6738]
push eax
lea eax, [ebp + 0x6938]
push eax
lea eax, [ebp + 0x2734]
push str._s_s__d__s__s
push eax
call fcn.10044ec8
add esp, 0x1c
jmp 0x10039be2
push 0x400
lea eax, [ebp + 0x5f38]
push 0
push eax
call fcn.10044b80
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp + 0x5f38]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x10039b45
lea eax, [ebp + 0x5f38]
push 0x20
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x10039b6b
lea eax, [ebp + 0x5f38]
jmp 0x10039b6c
inc eax
mov ecx, eax
xor esi, esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10039b73
sub ecx, edi
je 0x10039b9b
cmp byte [esi + eax], 0x7c
jne 0x10039b88
mov byte [esi + eax], 0x5f
mov ecx, eax
inc esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10039b8e
sub ecx, edi
cmp esi, ecx
jb 0x10039b7e
lea ecx, [ebp - 0x54]
push ecx
push eax
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x6738]
push eax
call fcn.1000770a
pop ecx
push eax
lea eax, [ebp + 0x6738]
push eax
lea eax, [ebp + 0x6938]
push eax
lea eax, [ebp + 0x2734]
push str._s_s__d__s__s_0___s
push eax
call fcn.10044ec8
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 0x20
mov esi, 0x88
mov eax, dword [0x1015568c]
cmp eax, esi
je 0x10039bf0
cmp eax, 0x44
jne 0x10039c4a
push str.SendInfoDisplayRansom_disp_666
push 0
call fcn.1004122a
pop ecx
pop ecx
jmp 0x10039c4a
cmp byte [0x102b4630], 0
je 0x10039c1d
xor eax, eax
mov cl, byte [eax + 0x102b4630]
mov byte [ebp + eax + 0x6738], cl
inc eax
test cl, cl
jne 0x10039c0b
lea eax, [ebp + 0x6738]
push eax
lea eax, [ebp + 0x6938]
push eax
lea eax, [ebp + 0x2734]
push 0x10062ca4
push eax
call fcn.10044ec8
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 0x10
mov esi, 0x88
mov eax, dword [0x1015568c]
cmp eax, esi
je 0x10039c58
cmp eax, 0x44
jne 0x10039c6e
lea eax, [ebp + 0x2734]
push eax
push str._tSendInfoDisplayRansom_:__s
push 0
call fcn.1004122a
add esp, 0xc
lea eax, [ebp + 0x2734]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10039c77
sub eax, edx
cmp eax, 0x1400
jbe 0x10039c8d
mov byte [ebp + 0x3b33], cl
mov ebx, dword [ebp - 0x6c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10039c95
sub eax, edx
jne 0x10039cb0
test dword [0x1015086c], 0x8000000
je 0x10039526
push 0x3ff
xor esi, esi
lea eax, [ebp + 0x5b39]
push esi
push eax
mov byte [ebp + 0x5b38], 0
call fcn.10044b80
lea edx, [ebp + 0x5b38]
add esp, 0xc
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10039cd8
push str.rundll32.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039dc5
push str.dllhost.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039dc5
push str.svchost.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039dc5
push str.msiexec.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039dc5
cmp byte [0x102d2d91], al
jne 0x10039d55
cmp dword [0x100774a8], 0x1f2e3d4c
jne 0x10039d55
mov eax, str._User_Behavior_
jmp 0x10039d96
cmp dword [0x102b45c4], esi
je 0x10039d64
mov eax, str._Disconnected_Manager_
jmp 0x10039d96
cmp byte [0x10153969], 0
je 0x10039d74
mov eax, str._Setup_
jmp 0x10039d96
cmp byte [0x10150897], 0
je 0x10039d84
mov eax, str._MS_Process_
jmp 0x10039d96
cmp byte [0x102b462f], 0
je 0x10039e62
mov eax, str._Process_Title_
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10039d98
lea edi, [ebp + 0x5b38]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10039da8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10039e62
push 0x400
lea eax, [ebp + 0x5f38]
push esi
push eax
call fcn.10044b80
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp + 0x5f38]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x10039de6
lea eax, [ebp + 0x5f38]
push 0x20
push eax
call fcn.10044a60
pop ecx
pop ecx
cmp eax, esi
jne 0x10039e0c
lea eax, [ebp + 0x5f38]
jmp 0x10039e0d
inc eax
mov ecx, eax
xor esi, esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10039e14
sub ecx, edi
je 0x10039e3c
cmp byte [esi + eax], 0x7c
jne 0x10039e29
mov byte [esi + eax], 0x5f
mov ecx, eax
inc esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10039e2f
sub ecx, edi
cmp esi, ecx
jb 0x10039e1f
cmp byte [0x10153969], 0
push eax
push ebx
lea eax, [ebp + 0x5b38]
je 0x10039e54
push str._s__s__setup_
jmp 0x10039e59
push str._s__s
push eax
call fcn.10044ec8
add esp, 0x10
test byte [0x10150868], 1
je 0x10039ee2
test dword [0x10077cc0], 0x2000
je 0x10039e83
cmp dword [ebp - 0x68], 0
lea ecx, [ebp + 0x4f34]
jne 0x10039e88
mov ecx, 0x10060ec9
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x10039e95
mov eax, dword [ebp - 0x64]
add eax, 0x58
push 0x1014d918
push ecx
push dword [ebp + 0x6950]
mov ecx, dword [ebp - 0x64]
push dword [ecx + 0x8b2c]
push eax
push dword [ebp + 0x695c]
lea eax, [ebp + 0x5b38]
push eax
lea eax, [ebp + 0x2734]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x6338]
push eax
lea eax, [ebp + 0x13ac]
push str._s_d_s_s_d_s_d_d_s_s
push eax
call fcn.10044ec8
add esp, 0x30
jmp 0x10039f63
test dword [0x10077cc0], 0x2000
je 0x10039f0f
cmp dword [ebp - 0x68], 0
lea ecx, [ebp + 0x4f34]
jne 0x10039eff
mov ecx, 0x10060ec9
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x10039f0c
mov eax, dword [ebp - 0x64]
add eax, 0x58
push ecx
jmp 0x10039f21
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x10039f1c
mov eax, dword [ebp - 0x64]
add eax, 0x58
push 0x10060ec9
push dword [ebp + 0x6950]
mov ecx, dword [ebp - 0x64]
push dword [ecx + 0x8b2c]
push eax
push dword [ebp + 0x695c]
lea eax, [ebp + 0x5b38]
push eax
lea eax, [ebp + 0x2734]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x6338]
push eax
lea eax, [ebp + 0x13ac]
push str._s_d_s_s_d_s_d_d_s
push eax
call fcn.10044ec8
add esp, 0x2c
lea eax, [ebp + 0x13ac]
push eax
lea eax, [ebp + 0x5938]
push eax
lea eax, [ebp + 0x5738]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.10042219
mov eax, dword [0x1015568c]
add esp, 0x10
cmp eax, 0x88
je 0x10039f97
cmp eax, 0x44
jne 0x10039fbb
lea eax, [ebp + 0x13ac]
push eax
lea eax, [ebp + 0x5938]
push eax
lea eax, [ebp + 0x5738]
push eax
push str.SendInfoDisplayRansom_disp_sKey_:__s_sVal_:__s_sData_:__s
push 0
call fcn.1004122a
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARE_trueEP_tc_Env
push esi
call fcn.10041961
mov eax, dword [0x1015568c]
add esp, 0x10
cmp eax, 0x11
je 0x10039fe4
cmp eax, 0x44
jne 0x10039ffa
lea eax, [ebp + 0x13ac]
push eax
push str.SendInfoDisplayRansom__s_
push 0
call fcn.1004122a
add esp, 0xc
lea eax, [ebp + 0x6338]
push eax
push dword [ebp - 0x6c]
call fcn.10037e4e
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
pop ecx
pop ecx
mov edi, 0x100610d8
push edi
xor ebx, ebx
push ebx
call esi
cmp eax, ebx
jne 0x1003a044
push edi
push ebx
call esi
cmp eax, ebx
jne 0x1003a044
push ebx
push str.tc_hnd
push str.SOFTWARE_trueEPTC_Env_tc_COMMUNICATION
push reloc.WS2_32.dll_bind
call fcn.10040c17
add esp, 0x10
cmp eax, ebx
je 0x1003a063
push dword [ebp - 0x5c]
push dword [ebp - 0x74]
push 0xc98
push eax
cmp dword [ebp - 0x60], ebx
je 0x1003a05d
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1003a063
call dword [sym.imp.USER32.dll_PostMessageA]
mov esi, 0x88
cmp dword [0x1015568c], esi
jne 0x1003a084
push dword [ebp - 0x5c]
push dword [ebp - 0x74]
push str.SendInfoDisplayRansom_disp_WPARAM_:__d_LPARAM_:__d
push ebx
call fcn.1004122a
add esp, 0x10
cmp dword [0x1015568c], 0x11
mov byte [0x102b4a44], 0
jne 0x1003a0a5
push dword [ebp - 0x60]
push str.SendInfoDisplayRansom_flag__SEND_CUT__d_
push ebx
call fcn.1004122a
add esp, 0xc
mov eax, dword [0x1015568c]
cmp eax, esi
je 0x1003a0b3
cmp eax, 0x44
jne 0x1003a0c0
push str.SendInfoDisplayRansom_End
push ebx
call fcn.1004122a
pop ecx
pop ecx
cmp dword [ebp - 0x60], ebx
je 0x1003a0e9
test byte [ebp + 0x694c], 4
je 0x1003a0e9
cmp dword [ebp + 0x6950], 0x80000000
jne 0x1003a0e9
mov dword [0x10150cbc], 0x63
call fcn.1002c8b0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp + 0x6940]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x6944
leave
ret 0x1c