Function at 0x10036ad0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x653c]
mov eax, 0x65bc
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x6538], eax
cmp dword [0x10144ee0], 0
mov eax, dword [ebp + 0x6550]
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp + 0x6558]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp + 0x655c]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x78], ecx
je 0x10036b1d
xor eax, eax
jmp 0x10037665
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.FTPD_
push eax
call edi
test eax, eax
je 0x10036b37
xor eax, eax
jmp 0x10037664
test dword [0x10144688], 0x2000000
push esi
mov esi, 0x10142448
je 0x10036b98
push str.SYSTEM32_
push esi
call edi
test eax, eax
jne 0x10036b61
push str.SysWOW64_
push esi
call edi
test eax, eax
je 0x10036b98
push str.SVCHOST.EXE
push esi
call edi
test eax, eax
jne 0x10036b91
push str._rundll32.exe
push esi
call edi
test eax, eax
jne 0x10036b91
push str.SERVICES.exe
push esi
call edi
test eax, eax
jne 0x10036b91
push str.DLLHOST.exe
push esi
call edi
test eax, eax
je 0x10036b98
xor eax, eax
jmp 0x10037663
mov eax, dword [ebp + 0x6544]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x100
push ebx
mov dword [ebp - 0x68], eax
je 0x10036bea
cmp dword [0x102a851c], 0
jne 0x10036bea
test dword [0x10144ef4], 0x40000
jne 0x10036bea
call esi
mov ebx, eax
sub ebx, dword [0x10144ee4]
call esi
mov eax, dword [0x10144ee0]
mov ecx, 0x2710
test eax, eax
je 0x10036de1
cmp ebx, ecx
jb 0x10036ded
push str.IE_Exploit_Magniber_RansomWare
push dword [ebp - 0x64]
call fcn.10047de9
pop ecx
pop ecx
mov ebx, reloc.WS2_32.dll_bind
test eax, eax
jne 0x10036e38
push 0x1400
lea eax, [ebp + 0x3b2c]
push eax
mov esi, str.tc_ExOKURL
push esi
mov edi, str.SOFTWARETrojanCut_tc_Env
push edi
push ebx
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10036c33
mov byte [ebp + 0x3b2c], 0
push 0x200
lea eax, [ebp + 0x6330]
push 0
push eax
call fcn.10040850
add esp, 0xc
cmp byte [0x1013f2f0], 0
je 0x10036c9b
xor eax, eax
mov cl, byte [eax + 0x1013f2f0]
mov byte [ebp + eax + 0x6330], cl
inc eax
test cl, cl
jne 0x10036c54
lea eax, [ebp + 0x6330]
push 0x2f
push eax
call fcn.10040730
pop ecx
pop ecx
test eax, eax
je 0x10036c9b
inc eax
push 0x2f
push eax
call fcn.10040730
pop ecx
pop ecx
test eax, eax
je 0x10036c9b
inc eax
push 0x2f
push eax
call fcn.10040730
pop ecx
pop ecx
test eax, eax
je 0x10036c9b
mov byte [eax], 0
cmp byte [ebp + 0x3b2c], 0
je 0x10036cca
cmp byte [ebp + 0x6330], 0
je 0x10036cca
lea eax, [ebp + 0x6330]
push eax
lea eax, [ebp + 0x3b2c]
push eax
call fcn.10040c70
pop ecx
pop ecx
test eax, eax
jne 0x100374d1
push 0x200
lea eax, [ebp + 0x4f2c]
push eax
push 0x90
push dword [0x102bc550]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp + 0x6330]
push eax
lea eax, [ebp + 0x4f2c]
push eax
lea eax, [ebp + 0x532c]
push eax
call fcn.10040b98
add esp, 0xc
push 4
push str.Warning
lea eax, [ebp + 0x532c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x10036e32
push 0x1400
lea eax, [ebp + 0x3b2c]
push eax
push esi
push edi
push ebx
call fcn.1003e4ea
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10036d46
mov byte [ebp + 0x3b2c], 0
lea eax, [ebp + 0x6330]
push eax
lea eax, [ebp + 0x3b2c]
push eax
call fcn.10040c70
pop ecx
pop ecx
test eax, eax
jne 0x10036dbf
lea edi, [ebp + 0x3b2c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10036d66
mov esi, 0x10060120
lea eax, [ebp + 0x6330]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10036d7d
lea edi, [ebp + 0x3b2c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10036d8d
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp + 0x3b2c]
push eax
push str.tc_ExOKURL
and ecx, 3
push str.SOFTWARETrojanCut_tc_Env
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.1003ef27
add esp, 0x10
lea eax, [ebp + 0x6330]
push eax
lea eax, [ebp + 0x3b2c]
push eax
push str.found_IE_Exploit_Magniber_RansomWare_ExceptURL__s_url__s_
push 0
call fcn.1003dfed
add esp, 0x10
jmp 0x100374d1
cmp ebx, 0x7d0
jae 0x10036bea
test eax, eax
je 0x10036dfd
sub dword [0x10144ee4], 0xbb8
jmp 0x10036e03
sub dword [0x10144ee4], ecx
mov eax, dword [0x101434ac]
cmp eax, 0x88
je 0x10036e1d
cmp eax, 0x44
je 0x10036e1d
cmp eax, 4
jne 0x100374d1
push ebx
push str.SendInfoDisplayRansom_cancel__d_
push 0
call fcn.1003dfed
add esp, 0xc
jmp 0x100374d1
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [ebp + 0x654c]
mov eax, dword [0x101434ac]
mov esi, 0x88
or ebx, 0x400
cmp eax, esi
je 0x10036e5c
cmp eax, 0x44
je 0x10036e5c
cmp eax, 4
jne 0x10036e80
push dword [ebp - 0x64]
push dword [0x1014469c]
push ebx
push dword [ebp + 0x6548]
push str.SendInfoDisplayRansom_0__08x__08x__08x__s
push 0
call fcn.1003dfed
mov eax, dword [0x101434ac]
add esp, 0x18
test byte [ebp + 0x654c], 1
jne 0x10036eae
push 0x10065e50
push dword [ebp - 0x64]
call edi
test eax, eax
je 0x10036ea9
push 0x1005f53c
push dword [ebp - 0x64]
call edi
test eax, eax
je 0x100374d1
mov eax, dword [0x101434ac]
cmp eax, esi
je 0x10036eb7
cmp eax, 0x44
jne 0x10036ed6
push dword [ebp - 0x64]
push dword [0x1014469c]
push ebx
push dword [ebp + 0x6548]
push str.SendInfoDisplayRansom_1__08x__08x__08x__s
push 0
call fcn.1003dfed
add esp, 0x18
cmp dword [0x10144694], 2
push 0x42
pop esi
jne 0x10036eec
test bl, 1
je 0x10036f0f
mov dword [ebp - 0x60], esi
mov ebx, esi
test bl, 1
je 0x10036f0f
cmp byte [0x10149960], 0
je 0x10036f0f
push 0x10142848
push 0x10149960
call edi
test eax, eax
je 0x10036f0f
mov dword [ebp - 0x60], esi
mov ebx, esi
push dword [ebp - 0x64]
or ebx, 0x400
mov dword [ebp - 0x60], ebx
call fcn.1000f149
pop ecx
test eax, eax
je 0x10036f3f
and ebx, 1
je 0x10036f38
test byte [ebp + 0x6544], 4
je 0x10036f38
call fcn.1002965e
mov eax, ebx
jmp 0x10037662
mov ebx, 0x1ff
push ebx
xor edi, edi
lea eax, [ebp + 0x5931]
push edi
push eax
mov byte [ebp + 0x5930], 0
call fcn.10040850
mov eax, dword [0x1013ee84]
add eax, 0xea60
push eax
mov esi, 0x1005d13c
lea eax, [ebp + 0x5930]
push esi
push eax
call fcn.10040b98
push ebx
lea eax, [ebp + 0x5b31]
push edi
push eax
mov byte [ebp + 0x5b30], 0
call fcn.10040850
push ebx
lea eax, [ebp + 0x6131]
push edi
push eax
mov byte [ebp + 0x6130], 0
call fcn.10040850
push ebx
lea eax, [ebp + 0x5d31]
push edi
push eax
mov byte [ebp + 0x5d30], 0
call fcn.10040850
push 0x1387
lea eax, [ebp + 0x13a5]
push edi
push eax
mov byte [ebp + 0x13a4], 0
call fcn.10040850
add esp, 0x48
mov edi, 0x13ff
push edi
lea eax, [ebp + 0x272d]
push 0
push eax
mov byte [ebp + 0x272c], 0
call fcn.10040850
push edi
lea eax, [ebp - 0x5b]
push 0
push eax
mov byte [ebp - 0x5c], 0
call fcn.10040850
mov eax, dword [0x1029e3fc]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x5b30]
push str.SoftWareTrojanCut_tc_Files
push eax
mov edi, edx
add edi, 0x64
inc dword [0x1029e3fc]
mov dword [ebp - 0x74], edi
call fcn.10040b98
push edi
lea eax, [ebp + 0x5d30]
push esi
push eax
call fcn.10040b98
lea eax, [ebp + 0x6130]
push eax
call fcn.1003dc1e
push ebx
lea eax, [ebp + 0x5f31]
push 0
push eax
mov byte [ebp + 0x5f30], 0
call fcn.10040850
lea eax, [ebp - 0x80]
push eax
call fcn.10040fd5
lea eax, [ebp - 0x80]
add esp, 0x40
push eax
call fcn.10040fae
pop ecx
test eax, eax
je 0x1003708f
push eax
push str._Y__m__d__H:_M:_S
lea esi, [ebx + 1]
lea eax, [ebp + 0x5f30]
push esi
push eax
call fcn.10041c5f
add esp, 0x10
jmp 0x100370a7
lea eax, [ebp + 0x5f30]
push str.0000
push eax
call fcn.100074d8
pop ecx
pop ecx
mov esi, 0x200
push 0x400
lea eax, [ebp + 0x552d]
push 0
push eax
mov byte [ebp + 0x552c], 0
call fcn.10040850
add esp, 0xc
test dword [0x10072cc0], 0x2000
je 0x100370e9
cmp dword [ebp - 0x6c], 0
je 0x100370e9
push esi
lea eax, [ebp + 0x552c]
push eax
push dword [ebp - 0x6c]
call fcn.1003d597
add esp, 0xc
xor eax, eax
lea edi, [ebp + 0x6531]
mov byte [ebp + 0x6530], 0
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x6544]
test al, 8
je 0x1003710a
mov esi, str.L__
jmp 0x10037147
cmp dword [ebp - 0x68], 0
je 0x10037117
mov esi, str.O__
jmp 0x10037147
test esi, eax
je 0x10037122
mov esi, str.D__
jmp 0x10037147
test al, 4
je 0x1003712d
mov esi, str.B__
jmp 0x10037147
test eax, 0x1000
je 0x1003713b
mov esi, str.F__
jmp 0x10037147
test eax, 0x2000
je 0x1003714f
mov esi, str.K__
lea edi, [ebp + 0x6530]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x60]
and eax, 1
mov dword [ebp - 0x68], eax
je 0x10037366
test byte [0x10072cc8], 2
je 0x10037366
mov esi, 0x1400
push esi
lea eax, [ebp + 0x272c]
push 0
push eax
call fcn.10040850
lea eax, [ebp + 0x272c]
push esi
push eax
call fcn.100317d6
mov eax, dword [0x101434ac]
mov esi, 0x88
add esp, 0x14
cmp eax, esi
je 0x100371a2
cmp eax, 0x44
jne 0x100371b0
push str.GetDLLStacks_end
push 0
call fcn.1003dfed
pop ecx
pop ecx
cmp byte [ebp + 0x272c], 0
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
je 0x100371e5
push str.createsoftwareinventory
lea eax, [ebp + 0x272c]
push eax
call edi
test eax, eax
je 0x100371e5
push str.SYSTEM32_rundll32.EXE
push 0x10142448
call edi
test eax, eax
jne 0x100374d1
mov eax, dword [0x101434ac]
cmp eax, esi
je 0x100371f3
cmp eax, 0x44
jne 0x10037201
push str.SendInfoDisplayRansom_disp_6
push 0
call fcn.1003dfed
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x6331]
push 0
push eax
mov byte [ebp + 0x6330], 0
call fcn.10040850
lea eax, [ebp + 0x6330]
push eax
lea eax, [ebp + 0x6130]
push eax
call fcn.1003d99e
mov eax, dword [0x101434ac]
add esp, 0x14
cmp eax, esi
je 0x1003723b
cmp eax, 0x44
jne 0x10037249
push str.SendInfoDisplayRansom_disp_66
push 0
call fcn.1003dfed
pop ecx
pop ecx
cmp byte [0x1029dff0], 0
je 0x10037266
xor eax, eax
mov cl, byte [eax + 0x1029dff0]
mov byte [ebp + eax + 0x6130], cl
inc eax
test cl, cl
jne 0x10037254
push str.rundll32.exe
lea eax, [ebp + 0x6130]
push eax
call edi
test eax, eax
jne 0x100372d9
push 0x10063b10
lea eax, [ebp + 0x6130]
push eax
call edi
test eax, eax
jne 0x100372d9
push str.svchost.exe
lea eax, [ebp + 0x6130]
push eax
call edi
test eax, eax
jne 0x100372d9
lea eax, [ebp + 0x272c]
push eax
lea eax, [ebp + 0x6330]
push eax
lea eax, [ebp + 0x6130]
push eax
call fcn.10007344
pop ecx
push eax
lea eax, [ebp + 0x6130]
push eax
lea eax, [ebp + 0x6530]
push eax
lea eax, [ebp - 0x5c]
push str._s_s__d__s__s
push eax
call fcn.10040b98
add esp, 0x1c
jmp 0x10037348
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp + 0x512c]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x100372e5
lea eax, [ebp + 0x512c]
push 0x20
push eax
call fcn.10040730
pop ecx
pop ecx
test eax, eax
jne 0x1003730b
lea eax, [ebp + 0x512c]
jmp 0x1003730c
inc eax
lea ecx, [ebp + 0x272c]
push ecx
push eax
lea eax, [ebp + 0x6330]
push eax
lea eax, [ebp + 0x6130]
push eax
call fcn.10007344
pop ecx
push eax
lea eax, [ebp + 0x6130]
push eax
lea eax, [ebp + 0x6530]
push eax
lea eax, [ebp - 0x5c]
push str._s_s__d__s__s_0___s
push eax
call fcn.10040b98
add esp, 0x20
mov eax, dword [0x101434ac]
cmp eax, esi
je 0x10037356
cmp eax, 0x44
jne 0x100373a7
push str.SendInfoDisplayRansom_disp_666
push 0
call fcn.1003dfed
pop ecx
pop ecx
jmp 0x100373a7
cmp byte [0x1029dff0], 0
je 0x10037383
xor eax, eax
mov cl, byte [eax + 0x1029dff0]
mov byte [ebp + eax + 0x6130], cl
inc eax
test cl, cl
jne 0x10037371
lea eax, [ebp + 0x6130]
push eax
lea eax, [ebp + 0x6530]
push eax
lea eax, [ebp - 0x5c]
push 0x1005eaf4
push eax
call fcn.10040b98
add esp, 0x10
mov esi, 0x88
mov eax, dword [0x101434ac]
cmp eax, esi
je 0x100373b5
cmp eax, 0x44
jne 0x100373c8
lea eax, [ebp - 0x5c]
push eax
push str._tSendInfoDisplayRansom_:__s
push 0
call fcn.1003dfed
add esp, 0xc
lea eax, [ebp - 0x5c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100373ce
sub eax, edx
cmp eax, 0x1400
jbe 0x100373e4
mov byte [ebp + 0x13a3], cl
test byte [0x1013ee90], 1
je 0x1003745a
test dword [0x10072cc0], 0x2000
je 0x10037405
cmp dword [ebp - 0x6c], 0
lea ecx, [ebp + 0x552c]
jne 0x1003740a
mov ecx, 0x1005ce9d
mov eax, dword [ebp - 0x78]
test eax, eax
jne 0x10037417
mov eax, dword [ebp - 0x70]
add eax, 0x58
push 0x1013cfe0
push ecx
push dword [ebp + 0x6548]
mov ecx, dword [ebp - 0x70]
push dword [ecx + 0x8b2c]
push eax
push dword [ebp + 0x6554]
lea eax, [ebp - 0x5c]
push dword [ebp - 0x64]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x5f30]
push eax
lea eax, [ebp + 0x13a4]
push str._s_d_s_s_d_s_d_d_s_s
push eax
call fcn.10040b98
add esp, 0x30
jmp 0x100374c0
test dword [0x10072cc0], 0x2000
je 0x10037472
cmp dword [ebp - 0x6c], 0
lea ecx, [ebp + 0x552c]
jne 0x10037477
mov ecx, 0x1005ce9d
mov eax, dword [ebp - 0x78]
test eax, eax
jne 0x10037484
mov eax, dword [ebp - 0x70]
add eax, 0x58
push ecx
push dword [ebp + 0x6548]
mov ecx, dword [ebp - 0x70]
push dword [ecx + 0x8b2c]
push eax
push dword [ebp + 0x6554]
lea eax, [ebp - 0x5c]
push dword [ebp - 0x64]
push eax
push dword [ebp - 0x60]
lea eax, [ebp + 0x5f30]
push eax
lea eax, [ebp + 0x13a4]
push str._s_d_s_s_d_s_d_d_s
push eax
call fcn.10040b98
add esp, 0x2c
mov eax, dword [ebp - 0x64]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100374c6
sub eax, edx
jne 0x100374d8
xor eax, eax
jmp 0x10037662
lea eax, [ebp + 0x13a4]
push eax
lea eax, [ebp + 0x5d30]
push eax
lea eax, [ebp + 0x5b30]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.1003ef27
mov eax, dword [0x101434ac]
add esp, 0x10
cmp eax, 0x88
je 0x1003750c
cmp eax, 0x44
jne 0x10037530
lea eax, [ebp + 0x13a4]
push eax
lea eax, [ebp + 0x5d30]
push eax
lea eax, [ebp + 0x5b30]
push eax
push str.SendInfoDisplayRansom_disp_sKey_:__s_sVal_:__s_sData_:__s
push 0
call fcn.1003dfed
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.1003e718
mov eax, dword [0x101434ac]
add esp, 0x10
cmp eax, 0x11
je 0x10037559
cmp eax, 0x44
jne 0x1003756f
lea eax, [ebp + 0x13a4]
push eax
push str.SendInfoDisplayRansom__s_
push 0
call fcn.1003dfed
add esp, 0xc
lea eax, [ebp + 0x5f30]
push eax
push dword [ebp - 0x64]
call fcn.10035acc
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
pop ecx
pop ecx
mov ebx, 0x1005d094
push ebx
push 0
call edi
test eax, eax
jne 0x100375b8
push ebx
push eax
call edi
test eax, eax
jne 0x100375b8
xor edi, edi
push edi
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push esi
call fcn.1003d897
add esp, 0x10
cmp eax, edi
je 0x100375d9
jmp 0x100375ba
xor edi, edi
push dword [ebp - 0x60]
push dword [ebp - 0x74]
push 0xc98
push eax
cmp dword [ebp - 0x68], edi
je 0x100375d3
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x100375d9
call dword [sym.imp.USER32.dll_PostMessageA]
mov esi, 0x88
cmp dword [0x101434ac], esi
jne 0x100375fa
push dword [ebp - 0x60]
push dword [ebp - 0x74]
push str.SendInfoDisplayRansom_disp_WPARAM_:__d_LPARAM_:__d
push edi
call fcn.1003dfed
add esp, 0x10
cmp dword [0x101434ac], 0x11
mov byte [0x1029e400], 0
jne 0x1003761b
push dword [ebp - 0x68]
push str.SendInfoDisplayRansom_flag__SEND_CUT__d_
push edi
call fcn.1003dfed
add esp, 0xc
mov eax, dword [0x101434ac]
cmp eax, esi
je 0x10037629
cmp eax, 0x44
jne 0x10037636
push str.SendInfoDisplayRansom_End
push edi
call fcn.1003dfed
pop ecx
pop ecx
cmp dword [ebp - 0x68], edi
je 0x1003765f
test byte [ebp + 0x6544], 4
je 0x1003765f
cmp dword [ebp + 0x6548], 0x80000000
jne 0x1003765f
mov dword [0x1013f2e0], 0x63
call fcn.1002965e
mov eax, dword [ebp - 0x68]
pop ebx
pop esi
pop edi
mov ecx, dword [ebp + 0x6538]
xor ecx, ebp
call fcn.1004083f
add ebp, 0x653c
leave
ret 0x1c