Function at 0x1003a717
Capabilities:
Accept command line arguments
Create thread
Enumerate gui resources
Get common file path
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x4968]
mov eax, 0x49e8
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x4964], eax
mov eax, dword [ebp + 0x4980]
push ebx
push esi
mov esi, dword [ebp + 0x4978]
push edi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x4984]
push 0x200
mov dword [ebp - 0x34], eax
xor ebx, ebx
lea eax, [ebp + 0x4764]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], esi
call fcn.10045030
mov eax, dword [ebp + 0x497c]
push 4
push 0x10063d68
push esi
mov dword [ebp - 0x30], eax
call fcn.100466d0
add esp, 0x18
lea edx, [ebp + 0x4764]
test eax, eax
jne 0x1003a7a1
lea eax, [esi + 4]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003a795
jmp 0x1003a7af
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003a7a5
lea eax, [ebp + 0x4764]
push eax
call fcn.10045308
lea eax, [ebp + 0x4764]
pop ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003a7c5
sub eax, edx
cmp eax, 3
jae 0x1003a7da
xor eax, eax
jmp 0x1003c11f
lea eax, [ebp + 0x4764]
push 0x7c
push eax
call fcn.10044f10
pop ecx
pop ecx
cmp eax, ebx
je 0x1003a7f0
mov byte [eax], bl
cmp dword [0x1015668c], ebx
je 0x1003a818
push dword [ebp - 0x34]
movzx eax, byte [ebp + 0x4988]
push eax
lea eax, [ebp + 0x4764]
push eax
push str.SendInfoDisplay_start:_s__d___s_
push ebx
call fcn.100412e2
add esp, 0x14
cmp byte [ebp + 0x4988], bl
jne 0x1003a882
lea eax, [ebp + 0x4764]
push eax
call fcn.10010979
pop ecx
test eax, eax
je 0x1003a882
mov byte [edi + 0x50bd], bl
mov byte [edi + 0x50bf], bl
test byte [0x102b5a50], 1
je 0x1003a85b
mov byte [edi + 0x50bc], 1
mov byte [edi + 0x1470], 1
mov byte [edi + 0x630c], 1
cmp dword [0x1015668c], ebx
je 0x1003a878
lea eax, [ebp + 0x4764]
push eax
push str.SendInfoDisplay_dup:_s
push ebx
call fcn.100412e2
add esp, 0xc
mov eax, dword [0x102b5a50]
jmp 0x1003c11c
cmp byte [0x102b562c], bl
jne 0x1003a916
test byte [0x10150600], 0x10
je 0x1003a916
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
xor eax, eax
lea edi, [ebp - 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push ebx
push ebx
push dword [ebp - 0x54]
call fcn.10047f00
mov ecx, dword [ebp - 0x58]
xor esi, esi
add eax, ecx
adc edx, esi
add eax, 0x5f5e100
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x80]
adc edx, ebx
push eax
mov dword [ebp - 0x54], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x1003a93d
mov byte [0x102b562c], al
lea eax, [ebp + 0x4764]
push eax
call fcn.1002dfad
pop ecx
test eax, eax
je 0x1003a985
cmp dword [0x1015668c], ebx
je 0x1003a7d3
push dword [ebp - 0x40]
push str.isLastXferFilter__s_
jmp 0x1003a977
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x10155a28
push dword [ebp - 0x40]
call esi
test eax, eax
jne 0x1003a95f
push str..dll
push dword [ebp - 0x40]
call esi
test eax, eax
je 0x1003a916
cmp dword [0x1015668c], ebx
je 0x1003a7d3
lea eax, [ebp + 0x4764]
push eax
push str.SendInfoDisplay_exp:_s
push ebx
call fcn.100412e2
add esp, 0xc
jmp 0x1003a7d3
lea eax, [ebp + 0x4764]
push eax
call fcn.10038368
pop ecx
test al, al
je 0x1003a9ac
cmp dword [0x1015668c], ebx
je 0x1003a7d3
push dword [ebp - 0x40]
push str.isWhiteFileExt__s_
jmp 0x1003a977
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x1003a9b7
cmp byte [eax], bl
jne 0x1003a9bd
mov eax, dword [ebp - 0x3c]
add eax, 0x58
mov dword [ebp - 0x44], eax
mov eax, 0x1000
test dword [ebp + 0x4970], eax
jne 0x1003a9d5
cmp dword [0x102b5a34], eax
jne 0x1003aa3a
mov esi, dword [ebp - 0x40]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003a9dd
sub eax, edx
cmp eax, 1
jbe 0x1003aa24
cmp byte [esi + 1], 0x3a
je 0x1003aa24
push 0x2e
push esi
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x1003aa24
mov edx, 0x102b5c58
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003aa08
cmp dword [0x1015668c], ebx
je 0x1003a7d3
push esi
jmp 0x1003a936
cmp byte [0x102b5c58], bl
jne 0x1003aa3a
mov esi, str.BlueTooth
mov edi, 0x102b5c58
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [0x10120dd0], bl
je 0x1003aa9c
mov esi, dword [ebp - 0x3c]
add esi, 0x58
mov edx, 0x10120dd0
mov edi, edx
mov eax, esi
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x1003aa6f
cmp cl, bl
je 0x1003aa6b
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x1003aa6f
inc eax
inc eax
inc edi
inc edi
cmp cl, bl
jne 0x1003aa51
xor eax, eax
jmp 0x1003aa74
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1003aa9c
cmp dword [0x1015668c], ebx
je 0x1003a7d3
push dword [ebp - 0x40]
push esi
push edx
push str.g_tc_GW__s___s___s_
push ebx
call fcn.100412e2
add esp, 0x14
jmp 0x1003a7d3
mov esi, dword [ebp - 0x44]
push 0xa
mov edi, str.127.0.0.1
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1003aac6
cmp dword [0x1015668c], ebx
je 0x1003a7d3
push dword [ebp - 0x40]
push str.127.0.0.1__s_
jmp 0x1003a977
mov eax, dword [ebp + 0x4974]
mov dword [ebp - 0x2c], eax
cmp byte [0x10157869], bl
je 0x1003ac57
cmp dword [0x10157ca4], ebx
je 0x1003abc0
cmp dword [ebp - 0x38], ebx
je 0x1003ab25
cmp dword [ebp - 0x38], 0x99
je 0x1003ab25
cmp dword [ebp - 0x34], ebx
je 0x1003ab54
mov eax, dword [ebp - 0x34]
cmp byte [eax], bl
je 0x1003ab54
push eax
call fcn.1000309c
pop ecx
test al, al
jne 0x1003ab54
mov dword [ebp - 0x2c], 1
cmp dword [0x1015668c], ebx
je 0x1003ab80
push dword [ebp - 0x34]
push str.SendInfoDisplay_PE_IE_cut_sDest:_s
jmp 0x1003ab4b
mov esi, dword [ebp - 0x3c]
add esi, 0x58
push esi
call fcn.1000309c
pop ecx
test al, al
jne 0x1003abae
mov dword [ebp - 0x2c], 1
cmp dword [0x1015668c], ebx
je 0x1003ab80
push esi
push str.SendInfoDisplay_PE_IE_cut_m_szIPAddress:_s
push ebx
call fcn.100412e2
add esp, 0xc
cmp dword [0x1015668c], ebx
je 0x1003ab80
lea eax, [ebp + 0x4764]
push eax
push dword [0x1015787c]
push dword [ebp - 0x2c]
push dword [ebp + 0x4970]
push str.SendInfoDisplay_1__08x__08x__08x__s
push ebx
call fcn.100412e2
add esp, 0x18
test dword [ebp + 0x4970], 0x2000
je 0x1003ad32
mov eax, dword [0x101580ac]
cmp eax, 3
jle 0x1003ad14
push dword [0x1015185c]
push 0x10037cdb
jmp 0x1003ad23
cmp dword [0x1015668c], ebx
je 0x1003ab80
push str.SendInfoDisplay_PE_IE_OK
jmp 0x1003ac4a
cmp byte [0x1015788a], bl
je 0x1003ac57
cmp byte [0x100a29c8], bl
je 0x1003abe0
cmp dword [0x100784a8], 0x5b6a7988
jne 0x1003abe7
mov dword [ebp - 0x2c], 1
mov byte [0x100a29c8], bl
cmp byte [0x100a3648], bl
je 0x1003ac39
cmp dword [ebp - 0x38], ebx
je 0x1003ac08
cmp dword [ebp - 0x38], 0x99
je 0x1003ac08
push dword [ebp - 0x34]
jmp 0x1003ac0f
mov eax, dword [ebp - 0x3c]
add eax, 0x58
push eax
call fcn.10003070
pop ecx
test al, al
je 0x1003ac20
mov dword [ebp - 0x2c], 1
cmp dword [0x1015668c], ebx
je 0x1003ab80
push str.SendInfoDisplay_disp
push ebx
call fcn.100412e2
pop ecx
pop ecx
cmp dword [0x1015668c], ebx
je 0x1003ab80
push str.SendInfoDisplay_g_tc_PE_IE__g_sbIsExplorer
push ebx
call fcn.100412e2
pop ecx
pop ecx
jmp 0x1003ab54
test dword [0x10150600], 0x1000
je 0x1003ab54
test byte [ebp + 0x4974], 1
je 0x1003ab54
cmp dword [ebp - 0x38], ebx
je 0x1003ab54
lea eax, [ebp + 0x4764]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003ac86
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
sub eax, edx
mov edi, eax
push str..EXE
lea eax, [ebp + 0x4764]
push eax
call esi
lea ecx, [ebp + edi + 0x4760]
cmp eax, ecx
je 0x1003ace1
lea eax, [ebp + 0x4764]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003acb9
sub eax, edx
mov edi, eax
push str..DLL
lea eax, [ebp + 0x4764]
push eax
call esi
lea ecx, [ebp + edi + 0x4760]
cmp eax, ecx
jne 0x1003ab54
mov eax, dword [ebp - 0x38]
cmp byte [eax], 0x4d
jne 0x1003ab54
cmp byte [eax + 1], 0x5a
jne 0x1003ab54
cmp dword [0x1015668c], ebx
je 0x1003a7d3
lea eax, [ebp + 0x4764]
push eax
push str.SendInfoDisplay_1_1_
jmp 0x1003a977
cmp eax, ebx
je 0x1003ad2b
push dword [0x1015185c]
push 0x10037dcd
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1003ad32
push ebx
call fcn.10037c59
pop ecx
movzx ecx, byte [0x101580d1]
mov eax, dword [0x102b5a34]
neg ecx
sbb ecx, ecx
and ecx, 0x2200
or ecx, eax
or ecx, 0x800
or dword [ebp + 0x4970], ecx
cmp dword [0x101580ac], 6
jne 0x1003ad65
or dword [ebp + 0x4970], eax
mov ecx, dword [ebp - 0x3c]
mov eax, 0x200
test dword [ecx + 0x3ea0], eax
je 0x1003ad7b
or dword [ebp + 0x4970], eax
test dword [ebp + 0x4970], 0x1000
je 0x1003ad91
and dword [ebp + 0x4970], 0xffffdfff
cmp dword [0x102b5a38], ebx
je 0x1003ada3
or dword [ebp + 0x4970], 0x20000
cmp dword [0x1015668c], 0x11
jne 0x1003adc0
push dword [ebp + 0x4970]
push str._MediaType_0x_08x
push ebx
call fcn.100412e2
add esp, 0xc
mov dword [0x102b5a34], ebx
mov esi, 0x104
mov edi, reloc.WS2_32.dll_bind
cmp dword [0x101580c0], ebx
jne 0x1003ade4
cmp byte [0x10152cd8], bl
je 0x1003aebf
push esi
lea eax, [ebp + 0x4460]
push ebx
push eax
call fcn.10045030
push esi
lea eax, [ebp + 0x4260]
push ebx
push eax
call fcn.10045030
push 0x10155c28
lea eax, [ebp + 0x4260]
push str._s_U
push eax
call fcn.10045378
push esi
lea eax, [ebp + 0x4460]
push eax
lea eax, [ebp + 0x4260]
push eax
push str.SoftWareTrojanCut_tc_MultiX
push edi
call fcn.100417d5
add esp, 0x38
cmp eax, 0xffffffff
jne 0x1003ae3e
mov byte [ebp + 0x4460], bl
cmp dword [0x1015668c], ebx
je 0x1003ae62
lea eax, [ebp + 0x4460]
push eax
lea eax, [ebp + 0x4260]
push eax
push str.SendInfoDisplay_sTC_Chrome___s__value__s_
push ebx
call fcn.100412e2
add esp, 0x10
mov esi, str.mail
cmp byte [0x10151cd0], bl
je 0x1003ae7f
push esi
push 0x10151cd0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003ae99
cmp byte [ebp + 0x4460], bl
je 0x1003aea5
push esi
lea eax, [ebp + 0x4460]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003aea5
or dword [ebp + 0x4970], 0x200
jmp 0x1003aebf
push 0x10060ec9
lea eax, [ebp + 0x4260]
push eax
push str.SoftWareTrojanCut_tc_MultiX
push edi
call fcn.100422d1
add esp, 0x10
cmp dword [0x1015668c], ebx
je 0x1003aef1
lea eax, [ebp + 0x4764]
push eax
push dword [0x10157874]
push dword [0x1015787c]
push dword [ebp - 0x2c]
push dword [ebp + 0x4970]
push str.SendInfoDisplay_Out__08x__08x__08x__08x__s
push ebx
call fcn.100412e2
add esp, 0x1c
lea eax, [ebp + 0x4764]
mov esi, 0x400
push esi
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x1d60]
push ebx
push eax
call fcn.10045030
mov edi, dword [ebp + 0x4970]
add esp, 0xc
mov dword [ebp - 0x44], edi
and dword [ebp - 0x44], 0x4000000
jne 0x1003afc1
lea eax, [ebp + 0x4764]
push 0x5c
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x1003afc1
push 0x200
lea eax, [ebp + 0x4364]
push ebx
push eax
call fcn.10045030
add esp, 0xc
lea eax, [ebp + 0x4364]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0x4764]
push eax
lea eax, [ebp + 0x4364]
push eax
lea eax, [ebp + 0x1d60]
push str._s_s
push eax
call fcn.10045378
lea eax, [ebp + 0x1d60]
push ebx
push eax
call fcn.100484ec
add esp, 0x18
test eax, eax
je 0x1003afb8
lea eax, [ebp + 0x4764]
push eax
mov ecx, 0x10189098
call fcn.1002b685
mov dword [ebp - 0x4c], eax
cmp eax, ebx
jne 0x1003afc1
lea eax, [ebp + 0x4764]
jmp 0x1003afbe
lea eax, [ebp + 0x1d60]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.1000770a
pop ecx
cmp eax, ebx
je 0x1003afd1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x3c]
call fcn.1003a66e
test dword [0x1015787c], edi
je 0x1003b19d
test dword [0x1016ef6c], 0x200
mov esi, 0x10095eb0
mov edi, 0x1016fd70
je 0x1003b02d
cmp byte [0x1016fd70], bl
je 0x1003b02d
cmp byte [0x10095eb0], bl
je 0x1003b02d
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b02d
cmp dword [0x1015668c], 0x11
jne 0x1003b212
push esi
push edi
push str._MediaType_pass_1___S___S_
jmp 0x1003b076
test dword [0x1016ef6c], 0x200
mov edi, 0x10156428
je 0x1003b084
cmp byte [0x10156428], bl
je 0x1003b084
cmp byte [0x10155a28], bl
je 0x1003b084
push 0x10155a28
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b084
cmp dword [0x1015668c], 0x11
jne 0x1003b212
push 0x10155a28
push edi
push str._MediaType_pass_2___S___S_
push ebx
call fcn.100412e2
add esp, 0x10
jmp 0x1003b212
test dword [ebp + 0x4970], 0x10000000
je 0x1003b15b
push 0x200
lea eax, [ebp + 0x4564]
push ebx
push eax
call fcn.10045030
lea eax, [ebp + 0x4564]
push eax
lea eax, [ebp + 0x4764]
push eax
call fcn.10037e38
add esp, 0x14
cmp byte [ebp + 0x4564], bl
je 0x1003b0de
lea eax, [ebp + 0x4564]
push eax
push 0x10181de0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003a7d3
mov eax, dword [0x1016ef6c]
test eax, 0x10000
je 0x1003b116
cmp byte [0x1016ff70], bl
je 0x1003b14f
cmp byte [ebp + 0x4564], bl
je 0x1003b14f
lea eax, [ebp + 0x4564]
push eax
push 0x1016ff70
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003b212
jmp 0x1003b14f
test eax, 0x20000
je 0x1003b14f
cmp byte [0x1016ff70], bl
je 0x1003b212
cmp byte [ebp + 0x4564], bl
je 0x1003b212
lea eax, [ebp + 0x4564]
push eax
push 0x1016ff70
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b212
mov dword [ebp - 0x2c], 0x11
jmp 0x1003b212
push 0x11
pop eax
mov dword [ebp - 0x2c], eax
cmp dword [0x1015668c], eax
jne 0x1003b212
push 0x10155a28
push edi
push esi
push 0x1016fd70
lea eax, [ebp + 0x4764]
push eax
mov eax, dword [0x101580d4]
push esi
push dword [ebp - 0x30]
shl eax, 0xa
push eax
push str.SEND_CUTDEVICE3__08x____08x_host:__s__file:__s__g_tc_OKWebMail:__s__g_szMailFromHost:__s__g_tc_OKMsg:__s__g_szMyExeName:__s_
push ebx
call fcn.100412e2
add esp, 0x28
jmp 0x1003b212
mov edx, dword [ebp - 0x30]
mov ecx, dword [0x1016ef6c]
mov eax, dword [0x101580d4]
cmp edx, ebx
je 0x1003b1c2
mov edi, eax
shl edi, 0xa
cmp edi, edx
ja 0x1003b1c2
test esi, ecx
je 0x1003b1c2
test byte [ebp - 0x2c], 2
jne 0x1003b1e3
mov esi, dword [0x101580e4]
shl esi, 0xa
cmp esi, edx
ja 0x1003b212
test ecx, 0x80000
je 0x1003b212
test dword [ebp + 0x4970], 0x200
je 0x1003b212
cmp dword [0x1015668c], 0x11
mov dword [ebp - 0x2c], 0x21
jne 0x1003b212
lea ecx, [ebp + 0x4764]
push ecx
push 0x10095eb0
push edx
shl eax, 0xa
push eax
push str.SEND_CUTDEVICESIZE4__08x____08x_host:_s_file:_s
push ebx
call fcn.100412e2
add esp, 0x18
mov eax, dword [0x10157890]
and eax, dword [ebp + 0x4970]
je 0x1003b22c
cmp dword [ebp - 0x44], ebx
je 0x1003b22c
push 0x11
pop esi
mov dword [ebp - 0x2c], esi
jmp 0x1003b22f
push 0x11
pop esi
cmp eax, ebx
je 0x1003b242
test dword [ebp + 0x4970], 0x1000
je 0x1003b242
mov dword [ebp - 0x2c], esi
lea eax, [ebp + 0x4764]
push eax
call fcn.1003845a
pop ecx
test al, al
je 0x1003b256
mov dword [ebp - 0x2c], esi
mov edi, dword [ebp - 0x40]
cmp dword [0x1015668c], ebx
je 0x1003b273
push dword [ebp - 0x34]
push edi
push str.SendInfoDisplay_Out_0__s___s_
push ebx
call fcn.100412e2
add esp, 0x10
cmp byte [ebp + 0x4988], bl
jne 0x1003b44d
cmp byte [edi + 1], 0x3a
je 0x1003b28e
test byte [ebp + 0x4974], 1
je 0x1003b2a3
cmp dword [0x101580c0], esi
je 0x1003b2a3
cmp dword [0x102b5a38], 0x40
jne 0x1003b44d
push 0x18
call fcn.10047777
mov esi, eax
pop ecx
cmp esi, ebx
je 0x1003b44d
cmp dword [0x1015668c], ebx
je 0x1003b2e5
push dword [0x102b5a38]
xor eax, eax
push dword [0x101580c0]
cmp byte [edi + 1], 0x3a
push dword [ebp - 0x34]
setne al
push edi
push eax
push str.SendInfoDisplay_Out_wait_5_sec_start__d___s___s___d___d_
push ebx
call fcn.100412e2
add esp, 0x1c
xor eax, eax
push 6
pop ecx
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x4970]
mov dword [esi], eax
mov eax, dword [ebp + 0x4974]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x497c]
mov dword [esi + 0xc], eax
lea eax, [ebp + 0x4764]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003b311
sub eax, edi
add eax, 0x200
push eax
call fcn.10045413
pop ecx
mov edi, eax
lea ecx, [ebp + 0x4764]
mov dword [esi + 8], edi
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1003b334
sub ecx, eax
add ecx, 0x200
push ecx
push ebx
push edi
call fcn.10045030
mov ecx, dword [esi + 8]
add esp, 0xc
lea eax, [ebp + 0x4764]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x1003b357
mov eax, dword [ebp - 0x38]
cmp eax, ebx
je 0x1003b3b9
cmp byte [eax], bl
je 0x1003b3b9
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003b36f
sub eax, edi
add eax, 0x200
push eax
call fcn.10045413
pop ecx
mov ecx, dword [ebp - 0x38]
mov edi, eax
mov dword [esi + 0x10], edi
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1003b38f
sub ecx, eax
add ecx, 0x200
push ecx
push ebx
push edi
call fcn.10045030
mov edx, dword [ebp - 0x38]
mov eax, dword [esi + 0x10]
add esp, 0xc
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
cmp cl, bl
jne 0x1003b3af
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x1003b411
cmp byte [eax], bl
je 0x1003b411
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003b3c7
sub eax, edi
add eax, 0x200
push eax
call fcn.10045413
pop ecx
mov ecx, dword [ebp - 0x34]
mov edi, eax
mov dword [esi + 0x14], edi
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1003b3e7
sub ecx, eax
add ecx, 0x200
push ecx
push ebx
push edi
call fcn.10045030
mov edx, dword [ebp - 0x34]
mov eax, dword [esi + 0x14]
add esp, 0xc
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
cmp cl, bl
jne 0x1003b407
lea eax, [ebp - 0x54]
push eax
push ebx
push esi
push 0x1003a326
push ebx
push ebx
call fcn.1004592d
add esp, 0x18
mov dword [0x100a2bec], eax
cmp dword [0x1015668c], ebx
je 0x1003c119
push dword [ebp - 0x40]
push str.SendInfoDisplay_Out_wait_5_sec__s_
push ebx
call fcn.100412e2
add esp, 0xc
jmp 0x1003c119
test byte [0x10157880], 1
mov dword [ebp - 0x44], ebx
jne 0x1003b567
cmp dword [ebp - 0x30], 0xa
jbe 0x1003b567
push dword [ebp - 0x4c]
call fcn.1004497f
pop ecx
mov edi, 0x200
test al, al
je 0x1003b56c
push edi
lea eax, [ebp + 0x4164]
push ebx
push eax
call fcn.10045030
push str.tc_fltr.exe
mov esi, 0x10154e28
push esi
lea eax, [ebp + 0x4164]
push str.__s_s_
push eax
call fcn.10045378
add esp, 0x1c
push str.Program_Files_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
push edi
lea eax, [ebp + 0x4564]
push ebx
push eax
call fcn.10045030
push dword [ebp - 0x4c]
lea eax, [ebp + 0x4564]
push str._r___s_
push eax
call fcn.10045378
add esp, 0x18
cmp dword [0x1015668c], 0x91
jne 0x1003b503
lea eax, [ebp + 0x4564]
push eax
lea eax, [ebp + 0x4164]
push eax
push str._ShellExec_4_chk_PerInfo__s__sFName_s
push ebx
call fcn.100412e2
add esp, 0x10
push ebx
push esi
lea eax, [ebp + 0x4564]
push eax
lea eax, [ebp + 0x4164]
push eax
push str.open
push ebx
push 0x1e
call fcn.1000d9a2
add esp, 0x1c
cmp eax, 0x3e7
jne 0x1003b56c
cmp dword [0x1015668c], 0x91
jne 0x1003b547
push dword [ebp - 0x4c]
push str._Found_a_Personal_Information__s
push ebx
call fcn.100412e2
add esp, 0xc
test byte [0x10157890], 1
je 0x1003b557
mov dword [ebp - 0x2c], 0x11
or dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x44], 1
jmp 0x1003b56c
mov edi, 0x200
test byte [ebp - 0x2c], 1
je 0x1003b610
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, ebx
je 0x1003b588
cmp byte [eax], bl
je 0x1003b588
mov esi, dword [ebp - 0x3c]
jmp 0x1003b592
mov esi, dword [ebp - 0x3c]
lea eax, [esi + 0x58]
cmp byte [eax], bl
je 0x1003b594
mov ecx, eax
cmp dword [0x10157874], 2
jne 0x1003b5a6
mov dword [ebp - 0x2c], 0x42
jmp 0x1003b5de
cmp ecx, ebx
je 0x1003b5de
push 0x1015c828
push 0x1015c9b8
push ecx
call fcn.100112c1
add esp, 0xc
test al, al
je 0x1003b5de
cmp dword [0x1015668c], 0x11
mov dword [ebp - 0x2c], 0x42
jne 0x1003b5de
push str.SendInfoDisplay_disp_13
push ebx
call fcn.100412e2
pop ecx
pop ecx
cmp byte [0x1015cb48], bl
je 0x1003b601
push 0x10155a28
push 0x1015cb48
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003b601
mov dword [ebp - 0x2c], 0x42
cmp dword [ebp - 0x44], 1
jne 0x1003b64e
or dword [ebp - 0x2c], 0x100
jmp 0x1003b64e
mov eax, dword [0x10157880]
mov ecx, eax
and ecx, dword [ebp + 0x4970]
test ecx, 0xfffbffff
je 0x1003b64b
cmp dword [0x1015668c], ebx
je 0x1003a7d3
push dword [ebp + 0x4970]
push eax
push str.SendInfoDisplay_Except:_d__d_
push ebx
call fcn.100412e2
add esp, 0x10
jmp 0x1003a7d3
mov esi, dword [ebp - 0x3c]
cmp byte [0x101580eb], bl
je 0x1003b672
push str.common.exe
push 0x10155428
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x1003b672
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
and eax, 1
mov dword [ebp - 0x64], eax
je 0x1003b692
mov byte [esi + 0x50bc], 1
mov byte [esi + 0x1470], 1
mov byte [esi + 0x630c], 1
mov eax, dword [ebp - 0x2c]
mov dword [0x102b5a50], eax
lea eax, [ebp + 0x4764]
push eax
mov byte [esi + 0x50bd], bl
mov byte [esi + 0x50bf], bl
call fcn.1001080d
pop ecx
test eax, eax
je 0x1003b6bf
mov eax, dword [ebp - 0x64]
jmp 0x1003c11f
cmp dword [0x1015668c], ebx
je 0x1003b6dc
lea eax, [ebp + 0x4764]
push eax
push str.SendInfoDisplay_disp_3:_s
push ebx
call fcn.100412e2
add esp, 0xc
push edi
lea eax, [ebp + 0x2160]
push ebx
push eax
call fcn.10045030
mov eax, dword [0x1015185c]
add eax, 0xea60
push eax
mov esi, 0x10061188
lea eax, [ebp + 0x2160]
push esi
push eax
call fcn.10045378
push edi
lea eax, [ebp + 0x3564]
push ebx
push eax
call fcn.10045030
push edi
lea eax, [ebp + 0x3f64]
push ebx
push eax
call fcn.10045030
push edi
lea eax, [ebp + 0x3764]
push ebx
push eax
call fcn.10045030
push 0x1388
lea eax, [ebp + 0x9d8]
push ebx
push eax
call fcn.10045030
add esp, 0x48
push 0xa00
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.10045030
push 0xa00
lea eax, [ebp + 0x2764]
push ebx
push eax
call fcn.10045030
mov eax, dword [0x102b5a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x3564]
push str.SoftWareTrojanCut_tc_Files
push eax
add edx, 0x64
inc dword [0x102b5a40]
mov dword [ebp - 0x54], edx
call fcn.10045378
push dword [ebp - 0x54]
lea eax, [ebp + 0x3764]
push esi
push eax
call fcn.10045378
lea eax, [ebp + 0x3f64]
push eax
call fcn.10040f13
lea eax, [ebp + 0x3f64]
push eax
call fcn.10038534
mov eax, dword [ebp - 0x2c]
push edi
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x3b64]
push ebx
push eax
call fcn.10045030
lea eax, [ebp - 0x70]
add esp, 0x40
push eax
call fcn.100457db
lea eax, [ebp - 0x70]
push eax
call fcn.100457b4
pop ecx
pop ecx
cmp eax, ebx
je 0x1003b800
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x3b64]
push edi
push eax
call fcn.10046465
add esp, 0x10
jmp 0x1003b813
lea eax, [ebp + 0x3b64]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
push 0x401
lea eax, [ebp + 0x2360]
push ebx
push eax
call fcn.10045030
add esp, 0xc
test dword [0x10078cc0], 0x2000
je 0x1003b84c
cmp dword [ebp - 0x38], ebx
je 0x1003b84c
push edi
lea eax, [ebp + 0x2360]
push eax
push dword [ebp - 0x38]
call fcn.1004095f
add esp, 0xc
cmp dword [ebp - 0x64], ebx
je 0x1003b9e9
test byte [0x10078cc8], 2
je 0x1003b9e9
lea eax, [ebp - 0x28]
push 0xa00
push eax
call fcn.100338b5
mov esi, 0x88
pop ecx
pop ecx
cmp dword [0x1015668c], esi
jne 0x1003b88c
push str.SendInfoDisplay_disp_6
push ebx
call fcn.100412e2
pop ecx
pop ecx
push edi
lea eax, [ebp + 0x4564]
push ebx
push eax
call fcn.10045030
lea eax, [ebp + 0x4564]
push eax
lea eax, [ebp + 0x3f64]
push eax
call fcn.10040e29
add esp, 0x14
cmp dword [0x1015668c], esi
jne 0x1003b8c5
push str.SendInfoDisplay_disp_66
push ebx
call fcn.100412e2
pop ecx
pop ecx
cmp byte [0x102b5630], bl
je 0x1003b8e1
xor eax, eax
mov cl, byte [eax + 0x102b5630]
mov byte [ebp + eax + 0x3f64], cl
inc eax
cmp cl, bl
jne 0x1003b8cf
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.rundll32.exe
lea eax, [ebp + 0x3f64]
push eax
call esi
test eax, eax
jne 0x1003b953
push str.dllhost.exe
lea eax, [ebp + 0x3f64]
push eax
call esi
test eax, eax
jne 0x1003b953
push str.svchost.exe
lea eax, [ebp + 0x3f64]
push eax
call esi
test eax, eax
jne 0x1003b953
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x4564]
push eax
lea eax, [ebp + 0x3f64]
push eax
call fcn.1000770a
pop ecx
push eax
lea eax, [ebp + 0x3f64]
push eax
lea eax, [ebp + 0x2764]
push str._s__d__s__s
push eax
call fcn.10045378
add esp, 0x18
jmp 0x1003b9d0
push 0x400
lea eax, [ebp + 0x3164]
push ebx
push eax
call fcn.10045030
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp + 0x3164]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x1003b974
lea eax, [ebp + 0x3164]
push 0x20
push eax
call fcn.10044f10
pop ecx
pop ecx
cmp eax, ebx
jne 0x1003b99a
lea eax, [ebp + 0x3164]
jmp 0x1003b99b
inc eax
lea ecx, [ebp - 0x28]
push ecx
push eax
lea eax, [ebp + 0x4564]
push eax
lea eax, [ebp + 0x3f64]
push eax
call fcn.1000770a
pop ecx
push eax
lea eax, [ebp + 0x3f64]
push eax
lea eax, [ebp + 0x2764]
push str._s__d__s__s_0___s
push eax
call fcn.10045378
add esp, 0x1c
cmp dword [0x1015668c], 0x88
jne 0x1003ba1a
push str.SendInfoDisplay_disp_666
push ebx
call fcn.100412e2
jmp 0x1003ba18
cmp byte [0x102b5630], bl
je 0x1003ba05
xor eax, eax
mov cl, byte [eax + 0x102b5630]
mov byte [ebp + eax + 0x3f64], cl
inc eax
cmp cl, bl
jne 0x1003b9f3
lea eax, [ebp + 0x3f64]
push eax
lea eax, [ebp + 0x2764]
push eax
call fcn.1000789a
pop ecx
pop ecx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x44], esi
and dword [ebp - 0x44], 1
je 0x1003ba5e
push edi
lea eax, [ebp + 0x3964]
push ebx
push eax
call fcn.10045030
push edi
lea eax, [ebp + 0x3964]
push eax
push str.tc_PerTxt
push str.SOFTWARETrueCutTC_FLT
push reloc.WS2_32.dll_bind
call fcn.100417d5
add esp, 0x20
cmp eax, 0xffffffff
jne 0x1003ba5e
mov byte [ebp + 0x3964], bl
mov eax, dword [0x1015668c]
cmp eax, 0x88
je 0x1003ba74
cmp eax, 0x44
je 0x1003ba74
cmp eax, 2
jne 0x1003ba90
lea eax, [ebp + 0x4764]
push eax
lea eax, [ebp + 0x2764]
push eax
push str._tSendInfoDisplay_:__s__s_
push ebx
call fcn.100412e2
add esp, 0x10
push str.rdpclip.exe
push 0x10155a28
call fcn.100077d0
pop ecx
pop ecx
cmp dword [ebp - 0x34], ebx
je 0x1003bab4
test eax, eax
jne 0x1003bad5
push str._tsclient
push dword [ebp - 0x34]
jmp 0x1003bac4
test eax, eax
jne 0x1003bad5
mov eax, dword [ebp - 0x3c]
push str._tsclient
add eax, 0x58
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003bad5
mov dword [ebp - 0x2c], 2
lea eax, [ebp + 0x2764]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003bade
sub eax, edx
cmp eax, 0xa00
jbe 0x1003baf4
mov byte [ebp + 0x3163], bl
push edi
lea eax, [ebp + 0x3d64]
push ebx
push eax
call fcn.10045030
add esp, 0xc
cmp dword [0x102b5a38], 0x40
jne 0x1003bb92
cmp byte [0x102b5a58], bl
je 0x1003bb92
xor eax, eax
mov cl, byte [eax + 0x102b5a58]
mov byte [ebp + eax + 0x3d64], cl
inc eax
cmp cl, bl
jne 0x1003bb1c
cmp dword [0x1015668c], ebx
je 0x1003bb4b
lea eax, [ebp + 0x3d64]
push eax
push str.ssDest__s_
push ebx
call fcn.100412e2
add esp, 0xc
mov edi, dword [ebp - 0x3c]
push str.sLog_ThreeTime_SIZE_3
push 1
push 1
push 1
push ebx
call fcn.1000150f
add esp, 0x14
test eax, eax
je 0x1003bb7b
lea eax, [ebp + 0x3d64]
push eax
call fcn.10033d04
pop ecx
test al, al
jne 0x1003a7d3
mov eax, dword [0x10151868]
and eax, 1
je 0x1003bbc1
cmp dword [ebp - 0x44], ebx
je 0x1003bbc1
lea eax, [ebp + 0x3964]
jmp 0x1003bbe1
mov eax, dword [ebp - 0x34]
lea edx, [ebp + 0x3d64]
cmp eax, ebx
je 0x1003bbad
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003bba1
jmp 0x1003bb4b
mov edi, dword [ebp - 0x3c]
lea eax, [edi + 0x58]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003bbb5
jmp 0x1003bb4e
cmp eax, ebx
je 0x1003bc2b
test dword [0x10078cc0], 0x2000
je 0x1003bbdc
lea eax, [ebp + 0x2360]
cmp dword [ebp - 0x38], ebx
jne 0x1003bbe1
mov eax, 0x10060ec9
or esi, dword [ebp + 0x4970]
push 0x1014e918
push eax
push esi
push dword [edi + 0x8b2c]
lea eax, [ebp + 0x3d64]
push eax
push dword [ebp - 0x30]
lea eax, [ebp + 0x2764]
push dword [ebp - 0x4c]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x3b64]
push eax
lea eax, [ebp + 0x9d8]
push str._s_d_s_s_d_s_d_d_s_s
push eax
call fcn.10045378
add esp, 0x30
jmp 0x1003bccb
mov ecx, dword [ebp + 0x4970]
test ecx, 0x1000
je 0x1003bc66
test dword [0x10078cc0], 0x2000
je 0x1003bc50
lea eax, [ebp + 0x2360]
cmp dword [ebp - 0x38], ebx
jne 0x1003bc55
mov eax, 0x10060ec9
push eax
or esi, ecx
push esi
push dword [edi + 0x8b2c]
push 0x102b5c58
jmp 0x1003bca0
cmp dword [ebp - 0x44], ebx
je 0x1003bc73
lea eax, [ebp + 0x3964]
jmp 0x1003bc8f
test dword [0x10078cc0], 0x2000
je 0x1003bc8a
lea eax, [ebp + 0x2360]
cmp dword [ebp - 0x38], ebx
jne 0x1003bc8f
mov eax, 0x10060ec9
push eax
or esi, ecx
push esi
push dword [edi + 0x8b2c]
lea eax, [ebp + 0x3d64]
push eax
push dword [ebp - 0x30]
lea eax, [ebp + 0x2764]
push dword [ebp - 0x4c]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x3b64]
push eax
lea eax, [ebp + 0x9d8]
push str._s_d_s_s_d_s_d_d_s
push eax
call fcn.10045378
add esp, 0x2c
lea eax, [ebp + 0x9d8]
push eax
lea eax, [ebp + 0x3764]
push eax
lea eax, [ebp + 0x3564]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.100422d1
mov eax, dword [0x1015668c]
add esp, 0x10
cmp eax, 0x88
je 0x1003bd04
cmp eax, 0x44
je 0x1003bd04
cmp eax, 2
jne 0x1003bd27
lea eax, [ebp + 0x9d8]
push eax
lea eax, [ebp + 0x3764]
push eax
lea eax, [ebp + 0x3564]
push eax
push str.SendInfoDisplay_disp_sKey_:__s_sVal_:__s_sData_:__s
push ebx
call fcn.100412e2
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.10041a19
add esp, 0x10
cmp dword [0x101580c0], ebx
je 0x1003bdc0
mov ecx, dword [0x10078cc0]
mov eax, 0x5000
and ecx, eax
cmp ecx, eax
jne 0x1003bdc0
mov edi, 0x104
push edi
lea eax, [ebp + 0x4260]
push ebx
push eax
call fcn.10045030
push 0x10155c28
lea eax, [ebp + 0x4260]
push 0x100614c0
push eax
call fcn.10045378
push 0x10060ec9
lea eax, [ebp + 0x4260]
push eax
push str.SoftWareTrojanCut_tc_MultiX
push esi
call fcn.100422d1
mov eax, dword [0x1015668c]
add esp, 0x28
cmp eax, 0x56
je 0x1003bdb1
cmp eax, 0x10
je 0x1003bdb1
cmp eax, 3
jne 0x1003bdc5
push str.isXferPacket_MySetRegUserStr_clear2
push ebx
call fcn.100412e2
pop ecx
pop ecx
jmp 0x1003bdc5
mov edi, 0x104
lea eax, [ebp + 0x3b64]
push eax
push dword [ebp - 0x4c]
call fcn.10037fe5
pop ecx
pop ecx
push 0x100610e0
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x44], eax
cmp eax, ebx
jne 0x1003be17
push 0x100610e0
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x44], eax
cmp eax, ebx
jne 0x1003be17
push ebx
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push esi
call fcn.10040ccf
add esp, 0x10
mov dword [ebp - 0x44], eax
cmp eax, ebx
je 0x1003be2b
push dword [ebp - 0x5c]
push dword [ebp - 0x54]
push 0xc98
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x1015668c], ebx
je 0x1003be52
lea eax, [ebp + 0x9d8]
push eax
lea eax, [ebp + 0x3764]
push eax
push dword [ebp - 0x44]
push str.SendInfoDisplay_File_0x_08x___s___s_
push ebx
call fcn.100412e2
add esp, 0x14
cmp dword [0x1015668c], 0x11
mov byte [0x102b5a44], bl
jne 0x1003be76
mov eax, dword [ebp - 0x2c]
and eax, 1
push eax
push str.SendInfoDisplay_flag__SEND_CUT__d_
push ebx
call fcn.100412e2
add esp, 0xc
test dword [0x1015786c], 0x20000000
je 0x1003beb3
cmp dword [ebp - 0x2c], 0x11
je 0x1003be8e
cmp dword [ebp - 0x2c], 0x21
jne 0x1003beb3
cmp dword [0x101580ac], ebx
jne 0x1003be9e
cmp byte [0x10152cd8], bl
je 0x1003beb3
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push fcn.100164b8
push ebx
push ebx
call fcn.1004592d
add esp, 0x18
cmp dword [0x101580c0], ebx
jne 0x1003bec7
cmp byte [0x100a2c18], bl
je 0x1003c0ef
push edi
lea eax, [ebp + 0x4460]
push ebx
push eax
call fcn.10045030
push edi
lea eax, [ebp + 0x4660]
push ebx
push eax
call fcn.10045030
mov esi, 0x208
push esi
lea eax, [ebp + 0x335c]
push ebx
push eax
call fcn.10045030
push edi
lea eax, [ebp + 0x4260]
push ebx
push eax
call fcn.10045030
push 0x10155c28
lea eax, [ebp + 0x4260]
push str._s_D
push eax
call fcn.10045378
push esi
lea eax, [ebp + 0x335c]
push eax
lea eax, [ebp + 0x4260]
push eax
push str.SoftWareTrojanCut_tc_MultiX
mov edi, reloc.WS2_32.dll_bind
push edi
call fcn.100417d5
add esp, 0x50
lea eax, [ebp + 0x335c]
mov dword [ebp - 0x30], eax
cmp byte [0x100a2c18], bl
je 0x1003bf54
mov dword [ebp - 0x30], 0x100a2c18
cmp dword [0x1015668c], ebx
je 0x1003bf6d
push dword [ebp - 0x30]
push str.SendInfoDisplay_sTC_Chrome_D__s_
push ebx
call fcn.100412e2
add esp, 0xc
mov eax, dword [ebp - 0x30]
cmp byte [eax], bl
je 0x1003c08f
mov esi, dword [ebp - 0x40]
cmp byte [esi + 1], 0x3a
jne 0x1003bfc6
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003bfa3
lea edx, [ebp + 0x4460]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003bf97
jmp 0x1003bfda
push 0x5c
push esi
call fcn.100476e0
pop ecx
pop ecx
cmp eax, ebx
je 0x1003bfda
inc eax
lea edx, [ebp + 0x4460]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003bfba
jmp 0x1003bfda
lea edx, [ebp + 0x4460]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1003bfd0
lea eax, [ebp + 0x4460]
push eax
push dword [ebp - 0x30]
call fcn.1004c839
pop ecx
pop ecx
test eax, eax
jne 0x1003c009
cmp byte [0x100a2c18], bl
je 0x1003c002
mov byte [0x100a2c18], bl
jmp 0x1003c08f
push 0x10060ec9
jmp 0x1003c07a
lea eax, [ebp + 0x4460]
push eax
lea eax, [ebp + 0x4660]
push str.__s_
push eax
call fcn.10045378
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x4660]
mov byte [ebp + eax + 0x4460], cl
inc eax
cmp cl, bl
jne 0x1003c026
lea eax, [ebp + 0x4460]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
cmp esi, ebx
je 0x1003c08f
lea ecx, [ebp + 0x4460]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x1003c058
sub ecx, edx
add ecx, esi
sub esi, ecx
mov al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
cmp al, bl
jne 0x1003c065
cmp byte [0x100a2c18], bl
jne 0x1003c08f
push dword [ebp - 0x30]
lea eax, [ebp + 0x4260]
push eax
push str.SoftWareTrojanCut_tc_MultiX
push edi
call fcn.100422d1
add esp, 0x10
cmp dword [0x1015668c], ebx
je 0x1003c0a8
push dword [ebp - 0x30]
push str.SendInfoDisplay_sTC_Chrome_D_End__s_
push ebx
call fcn.100412e2
add esp, 0xc
cmp dword [0x101580c0], ebx
je 0x1003c0ef
mov esi, 0x10155c28
push esi
lea eax, [ebp + 0x4660]
push str._s_D
push eax
call fcn.10045378
push 0x10060ec9
push esi
mov esi, str.SoftWareTrojanCut_tc_MultiX
push esi
push edi
call fcn.100422d1
push 0x10060ec9
lea eax, [ebp + 0x4660]
push eax
push esi
push edi
call fcn.100422d1
add esp, 0x2c
cmp byte [0x101580eb], bl
je 0x1003c119
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
call esi
push eax
call dword [0x1018797c]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2c]
and eax, 1
mov ecx, dword [ebp + 0x4964]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x4968
leave
ret 0x1c