Function at 0x481210
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4ef4b8
mov eax, dword fs:[0]
push eax
mov eax, 0x1488
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x1484], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x149c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x14ac]
push str.content
call fcn.0047f950
push str.config2
mov ecx, eax
call fcn.0047f950
mov esi, eax
push 0x5116d8
lea ecx, [esp + 0x48]
mov dword [esp + 0x30], esi
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x14a4], 0
push 0x5116d8
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 1
push 0x5116d8
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 2
push 0x5116d8
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 3
push 0x5116d8
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 4
push 0x5116d8
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 5
push 0x5116d8
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 6
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 7
push 0x5116d8
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 8
push 0x5116d8
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 9
push 0x5116d8
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 0xa
push 0x5116d8
lea ecx, [esp + 0x68]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 0xb
push 0x5116d8
lea ecx, [esp + 0x88]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 0xc
cmp word [esi + 0xe], 3
mov byte [esp + 0x43], 0
jne 0x481906
mov ecx, esi
mov esi, dword [ecx]
mov eax, dword [ecx + 8]
shl esi, 5
add esi, eax
push str.auto_patch
lea eax, [esp + 0x18]
push eax
call fcn.0047f8a0
cmp dword [eax], esi
je 0x481906
mov ecx, dword [esp + 0x2c]
push str.auto_patch
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x481906
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x68]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x88]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [esp + 0x2c]
push str.auto_patch
call fcn.0047f950
mov ebp, eax
xor ebx, ebx
cmp dword [ebp], ebx
jbe 0x481807
mov dword [esp + 0x54], ebx
jmp 0x481470
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x54]
mov edi, dword [ecx + eax]
lea esi, [ecx + eax]
mov eax, dword [esi + 8]
push str.file_name
lea edx, [esp + 0x98]
shl edi, 5
push edx
mov ecx, esi
add edi, eax
call fcn.0047f8a0
cmp dword [eax], edi
je 0x48150d
push str.file_name
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x4814b7
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x78], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0xd
lea edx, [esp + 0x84]
push edx
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0xe
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x80]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edi, dword [esi]
mov eax, dword [esi + 8]
shl edi, 5
add edi, eax
push str.dest
lea eax, [esp + 0x94]
push eax
mov ecx, esi
call fcn.0047f8a0
cmp dword [eax], edi
je 0x48159f
push str.dest
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x481549
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x78], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0xf
lea edx, [esp + 0x90]
push edx
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0x10
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x8c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edi, dword [esi]
mov eax, dword [esi + 8]
shl edi, 5
add edi, eax
push str.source
lea eax, [esp + 0x60]
push eax
mov ecx, esi
call fcn.0047f8a0
cmp dword [eax], edi
je 0x481628
push str.source
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x4815d8
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x78], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0x11
lea edx, [esp + 0x7c]
push edx
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0x12
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x78]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edi, dword [esi]
mov eax, dword [esi + 8]
shl edi, 5
add edi, eax
push str.hash
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0047f8a0
cmp dword [eax], edi
je 0x4816b1
push str.hash
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x481661
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x78], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0x13
lea edx, [esp + 0x74]
push edx
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0x14
push eax
lea ecx, [esp + 0x68]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x70]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x502ba4
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00402a60
mov byte [esp + 0x14b0], 0x15
lea edx, [esp + 0x3c]
push edx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.004029d0
mov byte [esp + 0x14bc], 0x16
push 0x502ba4
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.00402a60
mov byte [esp + 0x14c8], 0x17
lea edx, [esp + 0x5c]
push edx
push eax
lea eax, [esp + 0x8c]
push eax
call fcn.004029d0
mov byte [esp + 0x14d4], 0x18
push 0x502ba4
push eax
lea ecx, [esp + 0xb4]
push ecx
call fcn.00402a60
mov byte [esp + 0x14e0], 0x19
lea edx, [esp + 0xa0]
push edx
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.004029d0
add esp, 0x48
mov byte [esp + 0x14a4], 0x1a
push 0x5028f0
push eax
lea ecx, [esp + 0x70]
push ecx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x14a4], 0x1b
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x1a
lea ecx, [esp + 0x68]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x19
lea ecx, [esp + 0x6c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x18
lea ecx, [esp + 0x7c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x17
lea ecx, [esp + 0x60]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x16
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x15
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc ebx
add dword [esp + 0x54], 0x10
cmp ebx, dword [ebp]
jb 0x481470
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x48184a
mov eax, dword [eax - 0xc]
dec eax
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x1c
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x1d
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x1e
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x1400
lea edx, [esp + 0x9c]
push edx
push str.tc_h_auto_patch
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491b30
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4818cf
mov byte [esp + 0x98], 0
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
je 0x481906
mov ecx, dword [esp + 0x18]
push ecx
push str.tc_h_auto_patch
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
mov byte [esp + 0x43], 1
mov edi, dword [esp + 0x2c]
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
push str.white_process
lea edx, [esp + 0x20]
shl esi, 5
push edx
mov ecx, edi
add esi, eax
call fcn.0047f8a0
cmp dword [eax], esi
je 0x481eb0
push str.white_process
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x481eb0
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x68]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x88]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_ExceptProcessForm
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
push str.white_process
mov ecx, edi
call fcn.0047f950
mov ebp, eax
cmp dword [ebp], 0
mov dword [esp + 0x54], 0
jbe 0x481caf
xor ebx, ebx
lea ebx, [ebx]
mov eax, dword [ebp + 8]
mov edi, dword [ebx + eax]
lea esi, [ebx + eax]
mov eax, dword [esi + 8]
shl edi, 5
add edi, eax
push str.process_name
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0047f8a0
cmp dword [eax], edi
je 0x481ad6
push 0x5028fc
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 0x1f
push eax
push str.process_name
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x481a4c
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x20
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x14b0], 0x1f
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x21
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x22
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x21
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x1f
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edi, dword [esi]
mov eax, dword [esi + 8]
push str.ip_expire_time
lea ecx, [esp + 0x94]
push ecx
shl edi, 5
mov ecx, esi
add edi, eax
call fcn.0047f8a0
cmp dword [eax], edi
je 0x481bbb
push 0x5028fc
lea ecx, [esp + 0x70]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 0x23
push eax
push str.ip_expire_time
mov ecx, esi
call fcn.0047f950
mov edx, 0x1000
test word [eax + 0xe], dx
jne 0x481b2e
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x24
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x14b0], 0x23
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x25
push eax
lea ecx, [esp + 0x68]
push ecx
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x26
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x25
lea ecx, [esp + 0x60]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x23
lea ecx, [esp + 0x7c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x6c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edi, dword [esi]
mov eax, dword [esi + 8]
push str.process_path
lea edx, [esp + 0x78]
shl edi, 5
push edx
mov ecx, esi
add edi, eax
call fcn.0047f8a0
cmp dword [eax], edi
je 0x481c9a
push 0x5028fc
lea ecx, [esp + 0x7c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], 0x27
push eax
push str.process_path
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x481c10
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x28
lea edx, [esp + 0x78]
push edx
mov byte [esp + 0x14b0], 0x27
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x29
push eax
lea eax, [esp + 0x70]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x2a
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x29
lea ecx, [esp + 0x68]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x27
lea ecx, [esp + 0x70]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x78]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x54]
inc eax
add ebx, 0x10
mov dword [esp + 0x54], eax
cmp eax, dword [ebp]
jb 0x4819f0
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
je 0x481cf2
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x2b
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], 0
je 0x481d35
mov eax, dword [eax - 0xc]
dec eax
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x2c
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x38]
cmp dword [eax - 0xc], 0
je 0x481d78
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x2d
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x5028f0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.00402a60
mov byte [esp + 0x14b0], 0x2e
lea ecx, [esp + 0x3c]
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
call fcn.004029d0
mov byte [esp + 0x14bc], 0x2f
push 0x5028f0
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00402a60
mov bl, 0x30
mov byte [esp + 0x14c8], bl
lea ecx, [esp + 0x5c]
push ecx
push eax
lea edx, [esp + 0x40]
push edx
call fcn.004029d0
add esp, 0x30
mov byte [esp + 0x14a4], 0x31
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x2f
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0x2e
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x60]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x32
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x33
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edx, dword [esp + 0x18]
push edx
push str.tc_ExceptProcessForm
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edi, dword [esp + 0x3c]
add esp, 0x10
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
shl esi, 5
add esi, eax
push str.white_process_command_line
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0047f8a0
cmp dword [eax], esi
je 0x4820d8
push str.white_process_command_line
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x4820d8
push 0x5116d8
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_h_white_process_command_line
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push str.white_process_command_line
call fcn.0047f950
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jbe 0x481ffe
xor ebp, ebp
mov bl, 0x34
mov edi, edi
push 0x5028f0
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], bl
push eax
mov eax, dword [esi + 8]
add eax, ebp
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x481f6a
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x35
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x14b0], bl
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x36
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x37
push eax
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x36
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc edi
add ebp, 0x10
cmp edi, dword [esi]
jb 0x481f40
mov eax, dword [esp + 0x44]
cmp dword [eax - 0xc], 0
je 0x482041
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x38
push eax
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x44]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x39
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x3a
push eax
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x44]
push ecx
push str.tc_h_white_process_command_line
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esp + 0x54]
push edx
push str.tc_h_white_process_command_line
push str.SoftwareWow6432NodeTrojanCutTC_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edi, dword [esp + 0x4c]
add esp, 0x20
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
shl esi, 5
add esi, eax
push str.white_process_hash
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0047f8a0
cmp dword [eax], esi
je 0x482308
push str.white_process_hash
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x482308
push 0x5116d8
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_h_white_process_hash
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push str.white_process_hash
call fcn.0047f950
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jbe 0x48222e
xor ebp, ebp
mov bl, 0x3b
jmp 0x482170
push 0x5028f0
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], bl
push eax
mov eax, dword [esi + 8]
add eax, ebp
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x48219a
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x3c
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x14b0], bl
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x3d
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x3e
push eax
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x3d
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc edi
add ebp, 0x10
cmp edi, dword [esi]
jb 0x482170
mov eax, dword [esp + 0x4c]
cmp dword [eax - 0xc], 0
je 0x482271
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x3f
push eax
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x40
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x41
push eax
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x4c]
push ecx
push str.tc_h_white_process_hash
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esp + 0x5c]
push edx
push str.tc_h_white_process_hash
push str.SoftwareWow6432NodeTrojanCutTC_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edi, dword [esp + 0x4c]
add esp, 0x20
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
shl esi, 5
add esi, eax
push str.white_process_desc
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0047f8a0
cmp dword [eax], esi
je 0x482538
push str.white_process_desc
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x482538
push 0x5116d8
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_h_white_process_desc
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push str.white_process_desc
call fcn.0047f950
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jbe 0x48245e
xor ebp, ebp
mov bl, 0x42
jmp 0x4823a0
push 0x5028f0
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], bl
push eax
mov eax, dword [esi + 8]
add eax, ebp
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x4823ca
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x43
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x14b0], bl
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x44
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x45
push eax
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x44
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc edi
add ebp, 0x10
cmp edi, dword [esi]
jb 0x4823a0
mov eax, dword [esp + 0x34]
cmp dword [eax - 0xc], 0
je 0x4824a1
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x46
push eax
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x47
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x48
push eax
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x34]
push ecx
push str.tc_h_white_process_desc
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esp + 0x44]
push edx
push str.tc_h_white_process_desc
push str.SoftwareWow6432NodeTrojanCutTC_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edi, dword [esp + 0x4c]
add esp, 0x20
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
shl esi, 5
add esi, eax
push str.white_process_origin_copyright
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0047f8a0
cmp dword [eax], esi
je 0x482768
push str.white_process_origin_copyright
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x482768
push 0x5116d8
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_h_white_process_origin_copyright
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push str.white_process_origin_copyright
call fcn.0047f950
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jbe 0x48268e
xor ebp, ebp
mov bl, 0x49
jmp 0x4825d0
push 0x5028f0
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], bl
push eax
mov eax, dword [esi + 8]
add eax, ebp
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x4825fa
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x4a
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x14b0], bl
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x4b
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x4c
push eax
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x4b
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc edi
add ebp, 0x10
cmp edi, dword [esi]
jb 0x4825d0
mov eax, dword [esp + 0x3c]
cmp dword [eax - 0xc], 0
je 0x4826d1
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x44]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x4d
push eax
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x4e
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x4f
push eax
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x3c]
push ecx
push str.tc_h_white_process_origin_copyright
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esp + 0x4c]
push edx
push str.tc_h_white_process_origin_copyright
push str.SoftwareWow6432NodeTrojanCutTC_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edi, dword [esp + 0x4c]
add esp, 0x20
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
shl esi, 5
add esi, eax
push str.white_ransom_process_desc
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0047f8a0
cmp dword [eax], esi
je 0x482998
push str.white_ransom_process_desc
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x482998
push 0x5116d8
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_h_white_ransom_process_desc
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push str.white_ransom_process_desc
call fcn.0047f950
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jbe 0x4828be
xor ebp, ebp
mov bl, 0x50
jmp 0x482800
push 0x5028f0
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], bl
push eax
mov eax, dword [esi + 8]
add eax, ebp
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x48282a
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x51
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x14b0], bl
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x52
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x53
push eax
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x52
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc edi
add ebp, 0x10
cmp edi, dword [esi]
jb 0x482800
mov eax, dword [esp + 0x50]
cmp dword [eax - 0xc], 0
je 0x482901
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x58]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x54
push eax
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea edx, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x55
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x56
push eax
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x50]
push ecx
push str.tc_h_white_ransom_process_desc
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esp + 0x60]
push edx
push str.tc_h_white_ransom_process_desc
push str.SoftwareWow6432NodeTrojanCutTC_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edi, dword [esp + 0x4c]
add esp, 0x20
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
shl esi, 5
add esi, eax
push str.white_ransom_process_copyright
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0047f8a0
cmp dword [eax], esi
je 0x482bc8
push str.white_ransom_process_copyright
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x482bc8
push 0x5116d8
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_h_white_ransom_process_copyright
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push str.white_ransom_process_copyright
call fcn.0047f950
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jbe 0x482aee
xor ebp, ebp
mov bl, 0x57
jmp 0x482a30
push 0x5028f0
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], bl
push eax
mov eax, dword [esi + 8]
add eax, ebp
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x482a5a
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x58
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x14b0], bl
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x59
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x5a
push eax
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x59
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc edi
add ebp, 0x10
cmp edi, dword [esi]
jb 0x482a30
mov eax, dword [esp + 0x48]
cmp dword [eax - 0xc], 0
je 0x482b31
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x5b
push eax
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea edx, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x5c
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x5d
push eax
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x48]
push ecx
push str.tc_h_white_ransom_process_copyright
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edx, dword [esp + 0x58]
push edx
push str.tc_h_white_ransom_process_copyright
push str.SoftwareWow6432NodeTrojanCutTC_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov edi, dword [esp + 0x4c]
add esp, 0x20
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
shl esi, 5
add esi, eax
push str.black_process
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0047f8a0
cmp dword [eax], esi
je 0x4832b5
push str.black_process
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x4832b5
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x68]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
lea ecx, [esp + 0x88]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_h_black_process
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
push str.black_process
mov ecx, edi
call fcn.0047f950
mov ebx, eax
xor eax, eax
mov dword [esp + 0x80], eax
cmp dword [ebx], eax
jbe 0x48314c
mov dword [esp + 0x54], eax
lea esp, [esp]
mov eax, dword [ebx + 8]
mov ecx, dword [esp + 0x54]
lea esi, [ecx + eax]
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edi, dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x24]
mov ebp, dword [edx - 0xc]
shl edi, 5
add edi, eax
push str.process_name
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0047f8a0
cmp dword [eax], edi
je 0x482d59
push str.process_name
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x482d09
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0x5e
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0x5f
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x482d9f
push 0x5028fc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x14a4], 0x60
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edi, dword [esi]
mov eax, dword [esi + 8]
shl edi, 5
add edi, eax
push str.process_dll
lea eax, [esp + 0x94]
push eax
mov ecx, esi
call fcn.0047f8a0
cmp dword [eax], edi
je 0x482e3a
push str.process_dll
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x482dea
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0x61
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0x62
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x482e80
push 0x5028fc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x14a4], 0x63
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x60]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edi, dword [esi]
mov eax, dword [esi + 8]
shl edi, 5
add edi, eax
push str.process_desc
lea eax, [esp + 0x78]
push eax
mov ecx, esi
call fcn.0047f8a0
cmp dword [eax], edi
je 0x482f1b
push str.process_desc
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x482ec8
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0x64
lea edx, [esp + 0x80]
push edx
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0x65
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x7c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x482f61
push 0x5028fc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x74]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x14a4], 0x66
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x6c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edi, dword [esi]
mov eax, dword [esi + 8]
shl edi, 5
add edi, eax
push str.process_commandline
lea eax, [esp + 0x98]
push eax
mov ecx, esi
call fcn.0047f8a0
cmp dword [eax], edi
je 0x482ffc
push str.process_commandline
mov ecx, esi
call fcn.0047f950
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x482fac
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0x67
lea edx, [esp + 0x6c]
push edx
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0x68
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x68]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x483042
push 0x5028fc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x78]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x14a4], 0x69
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x70]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x24]
cmp ebp, dword [eax - 0xc]
je 0x48312c
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edi, dword [esi]
mov eax, dword [esi + 8]
push str.process_file_version
lea ecx, [esp + 0x8c]
push ecx
shl edi, 5
mov ecx, esi
add edi, eax
call fcn.0047f8a0
cmp dword [eax], edi
je 0x4830ea
push str.process_file_version
mov ecx, esi
call fcn.0047f950
mov edx, 0x1000
test word [eax + 0xe], dx
jne 0x48309a
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a8], 0x6a
lea eax, [esp + 0x7c]
push eax
mov byte [esp + 0x14ac], 0xc
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a4], 0x6b
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x78]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x5028fc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x94]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x14a4], 0x6c
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x8c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x80]
add dword [esp + 0x54], 0x10
inc eax
mov dword [esp + 0x80], eax
cmp eax, dword [ebx]
jb 0x482cb0
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
je 0x48318f
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x6d
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], 0
je 0x4831d2
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x6e
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x5028f0
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00402a60
mov bl, 0x6f
mov byte [esp + 0x14b0], bl
lea ecx, [esp + 0x3c]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
call fcn.004029d0
add esp, 0x18
mov byte [esp + 0x14a4], 0x70
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x8c], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x71
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x72
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edx, dword [esp + 0x18]
push edx
push str.tc_h_black_process
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
cmp word [edi + 0xe], 3
jne 0x4834d1
mov esi, dword [edi]
mov eax, dword [edi + 8]
shl esi, 5
add esi, eax
push str.ok_url
lea eax, [esp + 0x8c]
push eax
mov ecx, edi
call fcn.0047f8a0
cmp dword [eax], esi
je 0x4834d1
push str.ok_url
mov ecx, edi
call fcn.0047f950
cmp word [eax + 0xe], 4
jne 0x4834d1
push 0x5116d8
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x5116d8
push str.tc_h_ok_url
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push str.ok_url
call fcn.0047f950
mov esi, eax
xor edi, edi
cmp dword [esi], edi
jbe 0x483411
xor ebp, ebp
mov bl, 0x73
jmp 0x483350
push 0x5028fc
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14a4], bl
push eax
mov eax, dword [esi + 8]
add eax, ebp
mov ecx, 0x1000
test word [eax + 0xe], cx
jne 0x48337a
mov eax, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x90], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x14ac], 0x74
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x14b0], bl
call fcn.0048eab0
add esp, 8
mov byte [esp + 0x14a8], 0x75
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x14a4], 0x76
push eax
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x14a4], 0x75
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], bl
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
inc edi
add ebp, 0x10
cmp edi, dword [esi]
jb 0x483350
mov eax, dword [esp + 0x58]
cmp dword [eax - 0xc], 0
je 0x483454
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x60]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov byte [esp + 0x14a4], 0x77
push eax
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x58]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push ecx
lea edx, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x8c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x14a8], 0x78
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x14ac], 0xc
call fcn.0048ecd0
add esp, 8
mov byte [esp + 0x14a4], 0x79
push eax
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x14a4], 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x58]
push ecx
push str.tc_OKURLForm
push str.SOFTWARETrojanCutTC_Env_tc_CLIENT
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
mov byte [esp + 0x14a4], 0xb
lea ecx, [esp + 0x84]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0xa
lea ecx, [esp + 0x64]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 9
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 8
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 7
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 6
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 5
lea ecx, [esp + 0x58]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 4
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 3
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 2
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 1
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x14a4], 0
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x14a4], 0xffffffff
lea ecx, [esp + 0x44]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov al, byte [esp + 0x43]
mov ecx, dword [esp + 0x149c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1484]
xor ecx, esp
call fcn.004e0148
add esp, 0x1494
ret