Function at 0x100111ed
Capabilities:
Accept command line arguments
Create thread
Inspect section memory permissions
Resolve function by parsing pe exports
Terminate process
Terminate thread

Disassembly:
mov eax, 0x15a48
call fcn.10044f70
mov eax, dword [0x10083adc]
xor eax, esp
mov dword [esp + 0x15a44], eax
push esi
push edi
call fcn.100111c9
mov byte [0x10150895], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
mov dword [esp + 0x24], edi
call fcn.10044e58
mov esi, 0x10154628
mov dword [esp], str.af_setup.exe
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10011242
xor al, al
jmp 0x10014cf3
push str.af_un.exe
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1001123b
push str.af_un2.exe
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1001123b
push str.spoolsv.exe
push esi
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x1001127c
mov byte [0x1014edb9], 1
push ebx
push ebp
call fcn.1000ea9f
xor ebx, ebx
mov ebp, 0x10060ec9
cmp dword [0x1015568c], ebx
je 0x100112b5
mov eax, dword [0x10177770]
cmp eax, ebx
jne 0x1001129d
mov eax, ebp
mov ecx, edi
cmp edi, ebx
jne 0x100112a5
mov ecx, ebp
push eax
push ecx
push str.GetCommandLine__s_GetExpCmdLine__s_...
push ebx
call fcn.1004122a
add esp, 0x10
cmp edi, ebx
je 0x100112f8
mov esi, 0x10177770
cmp byte [edi], bl
je 0x100112f8
mov eax, dword [esi]
cmp eax, ebx
je 0x100112f8
cmp esi, 0x10177f70
jge 0x100112f8
push eax
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100112e2
add esi, 4
jmp 0x100112be
cmp dword [0x1015568c], ebx
je 0x1001401d
push str.OK_NOBHKOK_Except_CommandLine_Hook1
jmp 0x100117ba
call fcn.1000e897
push 0x104
lea eax, [esp + 0x1354]
push ebx
push eax
call fcn.10044b80
add esp, 0xc
cmp dword [0x10175b70], ebx
je 0x10011331
push ebx
lea eax, [esp + 0x1354]
push eax
push 0x10154228
call fcn.1003568d
add esp, 0xc
mov esi, 0x10175b70
cmp byte [esp + 0x1350], bl
je 0x1001137c
mov eax, dword [esi]
cmp eax, ebx
je 0x1001137c
cmp esi, 0x10176370
jge 0x1001137c
push eax
lea eax, [esp + 0x1354]
push eax
call fcn.1004c1f9
pop ecx
pop ecx
test eax, eax
je 0x10011366
add esi, 4
jmp 0x10011336
cmp dword [0x1015568c], ebx
je 0x1001401d
push str.OK_NOBHKOK_Except_GetHashFileSHA_256_Hook1
jmp 0x100117ba
call fcn.1000ecd4
cmp dword [0x1015568c], ebx
je 0x100113a3
mov eax, dword [0x10172b70]
cmp eax, ebx
jne 0x10011394
mov eax, ebp
push eax
push str.GetExpDefault__s_...
push ebx
call fcn.1004122a
add esp, 0xc
cmp dword [0x10172b70], ebx
je 0x100113d5
mov esi, 0x10172b70
cmp esi, 0x10173370
jge 0x100113d5
push dword [esi]
push 0x10154628
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100117a9
add esi, 4
cmp dword [esi], ebx
jne 0x100113b0
push 0x9fff
xor esi, esi
lea eax, [esp + 0x1a59]
push esi
push eax
mov byte [esp + 0x1a60], bl
call fcn.10044b80
push 0x4fff
lea eax, [esp + 0x10a65]
push esi
push eax
mov byte [esp + 0x10a6c], bl
call fcn.10044b80
push 6
push str.tc_Protocol
mov edi, str.SOFTWARE_trueEPTC_Env_tc_COMMUNICATION
push edi
mov ebp, reloc.WS2_32.dll_bind
push ebp
call fcn.10040c17
push esi
push str.tc_CUT_LOG_SEND_SERVER
push edi
push ebp
mov dword [0x10150870], eax
call fcn.10040c17
push esi
push str.tc_Option1
mov ebx, str.SOFTWARE_trueEPTC_Env_tc_CLIENT
push ebx
push ebp
mov dword [0x10150874], eax
call fcn.10040c17
add esp, 0x48
push esi
push str.tc_EdrL
push ebx
push ebp
mov dword [0x10150864], eax
call fcn.10040c17
mov esi, 0x200
push esi
mov edi, 0x1011fdd0
push edi
mov dword [0x10150868], eax
call fcn.10007867
push esi
push edi
push str.tc_GW
push str.SOFTWARE_trueEP_tc_Env
push ebp
call fcn.1004171d
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x10011498
mov byte [0x1011fdd0], 0
mov edi, 0xa000
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a60]
push eax
push str.tc_EDRLTraceExt
push ebx
push ebp
call fcn.1004171d
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x100114d0
mov byte [esp + 0x1a54], 0
push esi
mov esi, 0x10168550
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10011518
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10040933
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x10011511
push esi
push str.tc_EDRLTraceExt_:__s
push 0
call fcn.1004122a
add esp, 0xc
push esi
call fcn.10044e58
pop ecx
push str.office16
mov esi, 0x10154428
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1001153f
push str.office19
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10011546
mov byte [0x101570b1], 1
push 0x400
push 0
push 0x10112ba8
call fcn.10044b80
add esp, 0xc
test byte [0x10150868], 1
jne 0x10011570
cmp byte [0x101570b1], 0
je 0x100117d3
xor eax, eax
lea edi, [esp + 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push dword [0x10184a50]
movzx eax, word [esp + 0x3c]
push eax
movzx eax, word [esp + 0x3e]
push eax
movzx eax, word [esp + 0x40]
push eax
movzx eax, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x44]
push eax
push str._04d__02d__02d__02d:_02d:_02d__d
push 0x1014d918
call fcn.10044ec8
add esp, 0x24
xor esi, esi
test byte [0x10150868], 0x10
je 0x10011617
push esi
push dword [esp + 0x2c]
push 0x10154228
push 0x1000
call fcn.100389b5
add esp, 0x10
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x3ff
mov dword [esp + 0x20], eax
lea eax, [esp + 0x8f1]
push esi
push eax
mov byte [esp + 0x8f8], 0
call fcn.10044b80
add esp, 0xc
cmp dword [esp + 0x1c], esi
je 0x100117c6
xor eax, eax
inc eax
cmp dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle 0x1001179d
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x1001178b
cmp word [eax], 0
je 0x1001178b
xor esi, esi
push esi
push esi
push 0x400
lea ecx, [esp + 0x8f8]
push ecx
push 0xffffffffffffffff
push eax
push esi
push esi
call fcn.100444eb
add esp, 0x20
xor eax, eax
mov cl, byte [esp + eax + 0x8ec]
mov byte [esp + eax + 0xcec], cl
inc eax
test cl, cl
jne 0x100116a7
lea esi, [esp + 0xcec]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100116c6
sub eax, edx
cmp eax, 2
jbe 0x1001171c
cmp byte [esp + 0xcec], 0x22
jne 0x1001171c
lea eax, [esp + 0xcec]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100116e8
sub eax, edx
lea edi, [esp + 0xcec]
dec edi
cmp byte [eax + edi], 0x22
jne 0x1001171c
lea eax, [esp + 0xcec]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011709
sub eax, edx
mov byte [eax + edi], cl
lea esi, [esp + 0xced]
push esi
call fcn.10040a1f
pop ecx
test eax, eax
je 0x1001178b
cmp byte [0x101570b1], 0
je 0x10011747
push esi
call fcn.1000770a
pop ecx
push eax
push 0
push 0
push esi
mov ecx, 0x10188098
call fcn.1002b820
cmp dword [0x1015568c], 0x48
jne 0x10011760
push esi
push str.SendInfoDisplayEDRL_GetCommandLineW_:___s_
push 0
call fcn.1004122a
add esp, 0xc
test byte [0x10150868], 1
je 0x1001178b
mov edx, 0x10112ba8
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10011772
push 1
push 0
push esi
push 1
call fcn.10038491
add esp, 0x10
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
jl 0x1001166a
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100117d3
cmp dword [0x1015568c], ebx
je 0x1001401d
push str.OK_NOBHKOK_Except_Default_Hook1
push ebx
call fcn.1004122a
pop ecx
jmp 0x10013b4b
push str.errr_CommandLineToArgvW_null
push esi
call fcn.1004122a
pop ecx
pop ecx
xor esi, esi
push esi
push str.tc_Cut_List
push ebx
push ebp
call fcn.10040c17
add esp, 0x10
test dword [0x10150864], 0x800
mov dword [0x1015086c], eax
mov byte [0x1015686b], 0
je 0x10011808
test al, 2
jne 0x10011808
mov byte [0x1015686b], 1
cmp dword [0x1015568c], esi
je 0x10011826
movzx eax, byte [0x1015686b]
push eax
push str.g_bBackUp___d_
push esi
call fcn.1004122a
add esp, 0xc
push esi
push str.tc_DEMO
push str.SOFTWARE_trueEP_tc_Env
push ebp
call fcn.10040c17
push esi
push str.tc_Add
push ebx
push ebp
mov dword [0x102bed64], eax
call fcn.10040c17
add esp, 0x20
mov dword [0x10153a1c], eax
cmp eax, 0x40
jae 0x1001185c
mov dword [0x10153a1c], esi
push esi
push str.tc_PCTIME
push ebx
push ebp
call fcn.10040c17
add esp, 0x10
mov dword [0x101570d8], eax
cmp dword [0x1015568c], esi
je 0x10011aa1
mov esi, 0x10065154
test al, 0x40
mov edi, 0x10065150
mov eax, esi
jne 0x1001188f
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL___s_
push 0
call fcn.1004122a
add esp, 0xc
test byte [0x101570d8], 0x80
mov eax, esi
jne 0x100118ac
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x40000
mov eax, esi
jne 0x100118cc
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_HIGHST__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x100
mov eax, esi
jne 0x100118ec
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_MID__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x200
mov eax, esi
jne 0x1001190c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_WHOLE_HIGH__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x1000000
mov eax, esi
jne 0x1001192c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_HIGHST__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x400
mov eax, esi
jne 0x1001194c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_MID__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x800
mov eax, esi
jne 0x1001196c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_COMMON_HIGH__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x2000000
mov eax, esi
jne 0x1001198c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_HIGHST__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x1000
mov eax, esi
jne 0x100119ac
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_MID__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x2000
mov eax, esi
jne 0x100119cc
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_TRANSF_HIGH__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x4000000
mov eax, esi
jne 0x100119ec
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_HIGHST__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x4000
mov eax, esi
jne 0x10011a0c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_MID__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x8000
mov eax, esi
jne 0x10011a2c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_RANSOM_HIGH__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x8000000
mov eax, esi
jne 0x10011a4c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_HIGHST__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x10000
mov eax, esi
jne 0x10011a6c
mov eax, edi
push eax
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_MID__s_
push 0
call fcn.1004122a
add esp, 0xc
test dword [0x101570d8], 0x20000
jne 0x10011a8a
mov esi, edi
push esi
push str.PC_TIME_SECURITY_LEVEL_PC_TIME_SL_ZOMBI_HIGH__s_
push 0
call fcn.1004122a
mov eax, dword [0x101570d8]
add esp, 0xc
xor esi, esi
mov edx, 0x1111
test al, 0x40
je 0x10011b41
test al, al
jns 0x10011ae2
mov ecx, eax
and ecx, 0x200
je 0x10011ac3
test eax, 0x100
jne 0x10011b41
cmp ecx, esi
je 0x10011acf
or dword [0x1014f600], edx
jmp 0x10011b4b
test eax, 0x40000
jne 0x10011b2c
or dword [0x1014f600], 0x1014
jmp 0x10011b4b
mov edi, 0x1000
or dword [0x1014f600], edi
test eax, 0x1000000
je 0x10011afe
and dword [0x1014f600], 0xffffefff
mov ecx, eax
and ecx, 0x2000
je 0x10011b15
test edi, eax
je 0x10011b15
or dword [0x1014f600], 0x12
jmp 0x10011b4b
cmp ecx, esi
je 0x10011b25
or dword [0x1014f600], 0x111
jmp 0x10011b4b
test eax, 0x2000000
je 0x10011b38
or dword [0x1014f600], 0x101
jmp 0x10011b4b
or dword [0x1014f600], 0x14
jmp 0x10011b4b
or dword [0x1014f600], 0x1012
mov ecx, dword [0x101570c0]
cmp ecx, esi
je 0x10011b60
cmp ecx, 0x40
jae 0x10011b60
mov dword [0x1014f600], edx
cmp dword [0x1015568c], esi
je 0x10011c0b
push dword [0x1014f600]
push eax
push str.g_tc_PCTIME_0x_08x__g_TC_SECURITY_0x_08x_
push esi
call fcn.1004122a
add esp, 0x10
test byte [0x1014f600], 1
je 0x10011b97
push str.TC_SECURITY_COMM_RAW_on
push esi
call fcn.1004122a
pop ecx
pop ecx
test byte [0x1014f600], 2
je 0x10011bad
push str.TC_SECURITY_COMM_NOR_on
push esi
call fcn.1004122a
pop ecx
pop ecx
test byte [0x1014f600], 4
je 0x10011bc3
push str.TC_SECURITY_COMM_LOW_on
push esi
call fcn.1004122a
pop ecx
pop ecx
test byte [0x1014f600], 0x10
je 0x10011bd9
push str.TC_SECURITY_FLT_FILE_on
push esi
call fcn.1004122a
pop ecx
pop ecx
test dword [0x1014f600], 0x100
je 0x10011bf2
push str.TC_SECURITY_FLT_PACKET_128byte
push esi
call fcn.1004122a
pop ecx
pop ecx
test dword [0x1014f600], 0x1000
je 0x10011c0b
push str.TC_SECURITY_FLT_LOG_10sec
push esi
call fcn.1004122a
pop ecx
pop ecx
push str.MIN_FILE_SIZE
push 0x400
mov eax, 0x100
push 0x200
push eax
push eax
call fcn.1000150f
mov edi, str.sLog_tmpnAttackRateVal
push edi
mov esi, 0x190
push esi
push 0x12c
push 0xc8
push 0x64
mov dword [0x100db0a4], eax
call fcn.1000150f
push edi
mov dword [0x1014ede0], eax
push esi
mov eax, 0xc8
push eax
push eax
push 0x64
call fcn.1000150f
push edi
push 0xfa0
push 0x7d0
push 0x3e8
push 0x1f4
mov dword [0x10077490], eax
call fcn.1000150f
add esp, 0x50
push 2
push str.tc_STEALTH
push ebx
push ebp
mov dword [0x1007748c], eax
call fcn.10040c17
add esp, 0x10
mov dword [0x10077cd0], eax
test eax, 0xff000000
je 0x10011ca9
and eax, 0xfffffff8
mov dword [0x10077cd0], eax
push 0
push str.tc_SvrAgent
push ebx
push ebp
call fcn.10040c17
push 2
push str.tc_Sierra
push ebx
push ebp
mov dword [0x10150cb4], eax
call fcn.10040c17
or edi, 0xffffffff
push edi
push str.tc_Attachsize
push ebx
push ebp
mov dword [0x10150cb0], eax
call fcn.10040c17
push edi
push str.tc_Bodysize
push ebx
push ebp
mov dword [0x101570d4], eax
call fcn.10040c17
add esp, 0x40
push edi
push str.tc_BodyAttachsize
push ebx
push ebp
mov dword [0x101570dc], eax
call fcn.10040c17
mov dword [0x101570e0], eax
mov esi, 0xa000
push esi
lea eax, [esp + 0x1a68]
push eax
push str.tc_Dec
push ebx
push ebp
call fcn.1004171d
add esp, 0x24
cmp eax, edi
jne 0x10011d34
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
je 0x10011d97
lea eax, [esp + 0x1a54]
push 0x10147804
push eax
call fcn.10040933
pop ecx
pop ecx
xor eax, eax
mov cl, byte [eax + 0x10147804]
mov byte [esp + eax + 0x1a54], cl
inc eax
test cl, cl
jne 0x10011d54
lea eax, [esp + 0x1a54]
push eax
push str._s.doc
push 0x101477f0
call fcn.10044ec8
lea eax, [esp + 0x1a60]
push eax
push str._s.jpg
push 0x10147804
call fcn.10044ec8
add esp, 0x18
push esi
lea eax, [esp + 0x1a58]
push eax
push str.tc_OKMsg
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
jne 0x10011dbb
mov byte [esp + 0x1a54], 0
push 0x200
push 0x10155428
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10011dea
lea eax, [esp + 0x1a54]
push 0x10155428
push eax
call fcn.10040933
pop ecx
pop ecx
push esi
lea eax, [esp + 0x1a58]
push eax
push str.tc_OKWebMail
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
jne 0x10011e0e
mov byte [esp + 0x1a54], 0
push 0x200
mov esi, 0x1016ed70
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10011e3a
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10040933
pop ecx
pop ecx
xor esi, esi
push esi
push str.tc_NoINTERNET
push ebx
push ebp
call fcn.10040c17
push esi
push str.tc_UNUSETYPE
push ebx
push ebp
mov dword [0x10156878], eax
call fcn.10040c17
push esi
push str.tc_ReadOnlyTYPE
push ebx
push ebp
mov dword [0x1015687c], eax
call fcn.10040c17
push 0x12014000
push str.tc_WTYPE
push ebx
push ebp
mov dword [0x10156890], eax
call fcn.10040c17
add esp, 0x40
mov dword [0x10156880], eax
test eax, eax
js 0x10011ef1
test dword [0x10077cd0], 0x100000
je 0x10011edb
cmp dword [0x10151cdc], 0x10000
jae 0x10011edb
cmp byte [0x1015688a], 0
jne 0x10011edb
cmp byte [0x10150897], 0
jne 0x10011edb
cmp dword [0x102b4a48], esi
je 0x10011edb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 2
push 0x179f
push dword [0x102b4a48]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x10011ef1
cmp byte [eax], 0
je 0x10011ef1
push eax
push esi
call fcn.10035a5b
pop ecx
pop ecx
mov esi, 0x2800
push esi
mov edi, 0x10177f70
push edi
call fcn.10007867
push 0x1000
push 0x1017a770
call fcn.10007867
push esi
push 0x1016ef70
call fcn.10007867
push 0x64
push 0x10180de0
call fcn.10007867
add esp, 0x20
test dword [0x10156880], 0x10000000
mov esi, 0x5000
jne 0x10012146
push 0xa000
lea eax, [esp + 0x1a58]
push eax
push str.tc_OKURL
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10011f69
mov byte [esp + 0x1a54], 0
push esi
lea eax, [esp + 0xba58]
push eax
push str.tc_OKURLForm
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10011f8e
mov byte [esp + 0xba54], 0
cmp byte [esp + 0x1a54], 0
jne 0x10011fa6
cmp byte [esp + 0xba54], 0
je 0x1001211d
lea eax, [esp + 0x10a54]
push esi
push eax
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10011fd7
lea eax, [esp + 0x10a54]
push eax
lea eax, [esp + 0x1a58]
push eax
call fcn.10040933
pop ecx
pop ecx
cmp byte [esp + 0xba54], 0
je 0x10012031
cmp byte [esp + 0x1a54], 0
je 0x10012007
lea edi, [esp + 0x10a54]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10011ff3
mov esi, 0x10063740
movsw word es:[edi], word [esi]
mov edi, 0x10177f70
lea eax, [esp + 0x10a54]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012011
sub eax, edx
lea eax, [esp + eax + 0x10a54]
push eax
lea eax, [esp + 0xba58]
push eax
call fcn.10040933
pop ecx
pop ecx
xor eax, eax
mov cl, byte [esp + eax + 0x10a54]
mov byte [eax + 0x10177f70], cl
inc eax
test cl, cl
jne 0x10012033
cmp dword [0x1015568c], 0
je 0x1001205e
push edi
push str.TYPE_INTERNETURL_g_tc_OKURL_List___s_
push 0
call fcn.1004122a
add esp, 0xc
mov dword [0x1017a770], edi
xor edi, edi
lea eax, [esp + 0x10a54]
inc edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012071
sub eax, esi
cmp eax, edi
jbe 0x100120bd
mov esi, 0x1017a774
cmp esi, 0x1017b770
jge 0x100120bd
lea eax, [edi + 0x10177f71]
cmp byte [eax - 1], 0x3a
jne 0x100120a5
cmp byte [eax], 0
mov byte [eax - 1], 0
je 0x100120a5
mov dword [esi], eax
add esi, 4
lea eax, [esp + 0x10a54]
inc edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100120b0
sub eax, edx
cmp edi, eax
jb 0x10012083
xor edi, edi
cmp dword [0x1015568c], edi
je 0x100120fc
cmp dword [0x1017a770], edi
je 0x100120fc
mov esi, 0x400
cmp edi, esi
jge 0x10012101
push dword [edi*4 + 0x1017a770]
push edi
push str.g_ptc_OKURL_List___d___s_
push 0
call fcn.1004122a
add esp, 0x10
inc edi
cmp dword [edi*4 + 0x1017a770], 0
jne 0x100120d4
jmp 0x10012101
mov esi, 0x400
lea eax, [esp + 0x10a54]
push eax
push 0x10064c14
push 0x1016ef70
call fcn.10044ec8
add esp, 0xc
jmp 0x10012122
mov esi, 0x400
push 0x64
push 0x10180de0
push str.tc_RedirectURL
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001214b
mov byte [0x10180de0], 0
jmp 0x1001214b
mov esi, 0x400
cmp byte [0x1015688a], 0
je 0x1001217a
push 0x64
push 0x10180de0
push str.tc_RedirectURL
push ebx
push ebp
call fcn.1004171d
or edi, 0xffffffff
add esp, 0x14
cmp eax, edi
jne 0x1001217d
mov byte [0x10180de0], 0
jmp 0x1001217d
or edi, 0xffffffff
push 0x64
push 0x10180d78
push str.tc_PopBlackURL
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
jne 0x1001219e
mov byte [0x10180d78], 0
push 0x64
push 0x10155628
push str.tc_PopMailMsg
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
jne 0x100121bf
mov byte [0x10155628], 0
push 0x64
push 0x10155690
push str.tc_PopMailSizeMsg
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
jne 0x100121e0
mov byte [0x10155690], 0
push 0x64
push 0x101556f8
push str.tc_PopRansomMsg
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
jne 0x10012201
mov byte [0x101556f8], 0
push 0x104
push 0x10155760
push str.tc_BackUpFolder
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
jne 0x10012225
mov byte [0x10155760], 0
cmp byte [0x101570e7], 0
push esi
push 0x101578f8
push str.tc_sLocalIP
je 0x10012274
push str.Software_trueEP
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
jne 0x10012252
mov byte [0x101578f8], 0
push esi
push 0x10157cf8
push str.tc_sWebIP
push str.Software_trueEP
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, edi
mov edi, str.SOFTWARE_trueEPTC_Env_tc_COMMUNICATION
jmp 0x100122a7
mov edi, str.SOFTWARE_trueEPTC_Env_tc_COMMUNICATION
push edi
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001228f
mov byte [0x101578f8], 0
push esi
push 0x10157cf8
push str.tc_sWebIP
push edi
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100122b0
mov byte [0x10157cf8], 0
push esi
push 0x101570f8
push str.TC_User_name
push str.SOFTWARE_trueEP_tc_INSTALL
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100122d5
mov byte [0x101570f8], 0
push esi
push 0x101574f8
push str.TC_User_office
push str.SOFTWARE_trueEP_tc_INSTALL
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100122fa
mov byte [0x101574f8], 0
mov al, byte [0x101574f8]
test al, al
je 0x10012307
cmp al, 0x20
jne 0x1001232c
push esi
push 0x101574f8
push str.TC_Org
push str.SOFTWARE_trueEP_tc_INSTALL
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001232c
mov byte [0x101574f8], 0
mov al, byte [0x101574f8]
test al, al
je 0x10012339
cmp al, 0x20
jne 0x1001235e
push esi
push 0x101574f8
push str.TC_Section
push str.SOFTWARE_trueEP_tc_INSTALL
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001235e
mov byte [0x101574f8], 0
cmp dword [0x102bed64], 0
jne 0x1001237d
test dword [0x101570d8], 0x40000
mov dword [0x10082948], 0x3c
je 0x10012387
mov dword [0x10082948], 5
push 3
push str.tc_TCD
push ebx
push ebp
call fcn.10040c17
add esp, 0x10
mov dword [0x10077cdc], eax
test eax, eax
jne 0x100123ab
mov dword [0x10077cdc], 1
push 0x2000
push str.tc_FILE_SEND_SERVER
push edi
push ebp
call fcn.10040c17
push 5
push str.tc_CONNECT_POLLING_TIME
push edi
push ebp
mov dword [0x10077cc0], eax
call fcn.10040c17
push 1
push str.tc_FILE_EXP
push ebx
push ebp
mov dword [0x10077cd4], eax
mov byte [0x10077cba], 0
call fcn.10040c17
push 0
push str.tc_CARE
test eax, eax
setne al
push ebx
push ebp
mov byte [0x1015396b], al
call fcn.10040c17
mov dword [0x1015686c], eax
shr eax, 0x14
and eax, 0xf
add esp, 0x40
imul eax, eax, 0xa
push 0
push str.tc_ALLNOCUT
push ebx
push ebp
mov dword [0x10156870], eax
call fcn.10040c17
push 0
push str.tc_PER
push ebx
push ebp
mov dword [0x10156874], eax
call fcn.10040c17
push 0
push str.tc_EachNoCut_Per
test eax, eax
setne al
push ebx
push ebp
mov byte [0x10156889], al
call fcn.10040c17
push 0x14
push str.tc_DDX_H_Q
push ebx
push ebp
mov dword [0x1014f5fc], eax
call fcn.10040c17
add esp, 0x40
push 2
push str.tc_DDX_H_S
push ebx
push ebp
mov dword [0x10082928], eax
call fcn.10040c17
push 0x14
push str.tc_DDX_H_G
push ebx
push ebp
mov dword [0x1008292c], eax
call fcn.10040c17
push 0x14
push str.tc_DDX_T_C
push ebx
push ebp
mov dword [0x10082930], eax
call fcn.10040c17
push 2
push str.tc_DDX_T_S
push ebx
mov dword [0x10082934], eax
push ebp
call fcn.10040c17
add esp, 0x40
push 0x14
push str.tc_DDX_U
push ebx
push ebp
mov dword [0x10082938], eax
call fcn.10040c17
push 1
push str.tc_DDX_I
push ebx
push ebp
mov dword [0x1008293c], eax
call fcn.10040c17
push 3
push str.tc_DDX_S
push ebx
push ebp
mov dword [0x10082940], eax
call fcn.10040c17
push 0
push str.tc_W_L
push ebx
push ebp
mov dword [0x10082944], eax
call fcn.10040c17
add esp, 0x40
push 0
push str.tc_DDOS_KILL
push ebx
push ebp
mov dword [0x101570e8], eax
call fcn.10040c17
push 0
push str.tc_DDOS_AP
push ebx
push ebp
mov dword [0x10156884], eax
call fcn.10040c17
push 0
push str.tc_Speed
test eax, eax
setne al
push ebx
push ebp
mov byte [0x10156888], al
call fcn.10040c17
mov ecx, eax
and ecx, 0x101000
mov dword [0x10152564], ecx
mov ecx, eax
shr ecx, 0x11
and cl, 1
mov byte [0x10151cda], cl
mov ecx, eax
and ecx, 0x21e000
mov dword [0x100774b4], ecx
mov ecx, eax
push 0
mov dword [0x1015acfc], eax
push str.tc_WaterMark
shr ecx, 0x12
shr eax, 0x13
and cl, 1
and al, 1
push ebx
push ebp
mov byte [0x10151cdb], cl
mov byte [0x10153968], al
call fcn.10040c17
add esp, 0x40
push 0
push str.tc_WM_Height
push ebx
push ebp
mov dword [0x1015ad00], eax
call fcn.10040c17
push 0
push str.tc_WM_Blend
mov dword [0x101477e8], eax
push ebx
push ebp
call fcn.10040c17
push 0
push str.tc_India
push edi
push ebp
mov dword [0x101477ec], eax
call fcn.10040c17
push 0
push str.tc_IndiaSystem
push edi
push ebp
mov dword [0x10184c78], eax
call fcn.10040c17
add esp, 0x40
push 0
push str.tc_India_IO32
push edi
push ebp
mov dword [0x10184c7c], eax
call fcn.10040c17
mov dword [0x10184c80], eax
mov eax, dword [0x101477ec]
add esp, 0x10
test eax, eax
jle 0x10012614
cmp eax, 0xff
jle 0x1001261e
mov dword [0x101477ec], 0x80
push 0
push str.tc_WM_S_FontSize
push ebx
push ebp
call fcn.10040c17
add esp, 0x10
mov dword [0x101477e0], eax
test eax, eax
jle 0x1001263f
cmp eax, 0x1f4
jle 0x10012649
mov dword [0x101477e0], 0xc8
push 0
push str.tc_WM_S_FontWeight
push ebx
push ebp
call fcn.10040c17
add esp, 0x10
cmp eax, 0x64
mov dword [0x1014eda0], eax
jl 0x1001266b
cmp eax, 0x384
jle 0x10012675
mov dword [0x1014eda0], 0x2bc
push 0
push str.tc_WM_S_FontColor
push ebx
push ebp
call fcn.10040c17
push 0x1ff
mov dword [0x100db0a0], eax
lea eax, [esp + 0x1469]
push 0
push eax
mov byte [esp + 0x1470], 0
call fcn.10044b80
add esp, 0x1c
mov edi, 0x200
push edi
lea eax, [esp + 0x1458]
push eax
push 0x6d
push dword [0x102d2d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
push 0x1015ad08
push str.tc_WM_S_FontName
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100126f1
lea eax, [esp + 0x1454]
push eax
push 0x1015ad08
call fcn.1000789a
pop ecx
pop ecx
test byte [0x1015ad00], 1
je 0x10012732
cmp byte [0x1015ad08], 0
jne 0x10012732
lea eax, [esp + 0x1454]
push eax
push 0x1015ad08
call fcn.1000789a
and dword [0x100db0a0], 0
pop ecx
pop ecx
mov dword [0x101477e0], 0xa
mov dword [0x1014eda0], 0x2bc
push edi
lea eax, [esp + 0x1458]
push eax
push 0x6e
push dword [0x102d2d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
mov esi, 0x1015b108
push esi
push str.tc_WM_S_String
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10012774
lea eax, [esp + 0x1454]
push eax
push esi
call fcn.1000789a
pop ecx
pop ecx
push 0
push str.tc_DELTOOLBAR
push ebx
push ebp
call fcn.10040c17
push 0
push str.tc_DetectType
push ebx
push ebp
mov dword [0x1016ed68], eax
call fcn.10040c17
push edi
push 0x10155868
push str.TC_TCServer
mov esi, str.SOFTWARE_trueEP_tc_INSTALL
push esi
push ebp
mov dword [0x1016df64], eax
call fcn.1004171d
add esp, 0x34
cmp eax, 0xffffffff
jne 0x100127c0
mov byte [0x10155868], 0
test dword [0x10150864], 0x20000000
mov byte [0x1015062d], 0
je 0x100127da
mov byte [0x1015062d], 1
push edi
push 0x10155a68
push str.TC_PatchServer
push esi
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100127fb
mov byte [0x10155a68], 0
xor esi, esi
inc esi
push esi
push str.tc_COMMIT_POPUP
push ebx
push ebp
call fcn.10040c17
push esi
push str.tc_COMMIT_LIST
push ebx
push ebp
mov dword [0x10077cbc], eax
call fcn.10040c17
or dword [0x10077cbc], eax
push esi
push str.tc_COMMIT_LOG_SAVEFILE
push ebx
push ebp
call fcn.10040c17
or dword [0x10077cbc], eax
push esi
push str.tc_Cut_USB
push ebx
push ebp
call fcn.10040c17
add esp, 0x40
push esi
push str.tc_PE_IE
push ebx
push ebp
mov byte [0x10156868], al
call fcn.10040c17
add esp, 0x10
test eax, eax
setne al
test dword [0x1015686c], 0x80000000
mov esi, 0x111111
mov byte [0x10156869], al
push esi
je 0x1001287e
push str.tc_AutoEngine
jmp 0x10012883
push str.tc_Engine
push ebx
push ebp
call fcn.10040c17
add esp, 0x10
mov dword [0x10077cc4], eax
test eax, eax
jne 0x1001289c
mov dword [0x10077cc4], esi
push 0
push str.tc_fasoo
push str.SOFTWARE_trueEP_tc_Env
push ebp
call fcn.10040c17
mov dword [0x10151ce0], eax
mov esi, 0xa000
lea eax, [esp + 0x1a64]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a70]
push eax
push str.tc_ExceptIP
push ebx
push ebp
call fcn.1004171d
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x100128eb
mov byte [esp + 0x1a54], 0
push 0x600
push 0x1015db48
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012942
lea eax, [esp + 0x1a54]
push 0x1015db48
push eax
call fcn.10040933
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x10012937
push 0x1015db48
push str.tc_ExceptIP_:__s
push 0
call fcn.1004122a
add esp, 0xc
push 0x1015db48
call fcn.10010fbf
pop ecx
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_FileExtExp
push ebx
push ebp
call fcn.1004171d
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10012975
mov byte [esp + 0x1a54], 0
push edi
push 0x10168150
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x100129c8
lea eax, [esp + 0x1a54]
push 0x10168150
push eax
call fcn.10040933
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x100129bd
push 0x10168150
push str.tc_FileExtExp_:__s
push 0
call fcn.1004122a
add esp, 0xc
push 0x10168150
call fcn.10044e58
pop ecx
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_FileExtCut
push ebx
push ebp
call fcn.1004171d
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x100129fb
mov byte [esp + 0x1a54], 0
push edi
mov edi, 0x10168350
push edi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012a43
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10040933
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x10012a3c
push edi
push str.tc_FileExtCut_:__s
push 0
call fcn.1004122a
add esp, 0xc
push edi
call fcn.10044e58
pop ecx
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_ExceptDLLs
push ebx
push ebp
call fcn.1004171d
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10012a76
mov byte [esp + 0x1a54], 0
push 0x1000
mov edi, 0x1015cb48
push edi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012ac2
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10040933
push edi
call fcn.10044e58
add esp, 0xc
cmp dword [0x1015568c], 0
je 0x10012ac2
push edi
push str.tc_ExceptDLLs_:__s
push 0
call fcn.1004122a
add esp, 0xc
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_ForceCom
push ebx
push ebp
call fcn.1004171d
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10012af5
mov byte [esp + 0x1a54], 0
push 0x1000
mov esi, 0x1015bb48
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10012b41
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10040933
push esi
call fcn.10044e58
add esp, 0xc
cmp dword [0x1015568c], 0
je 0x10012b41
push esi
push str.tc_ForceCom_:__s
push 0
call fcn.1004122a
add esp, 0xc
lea eax, [esp + 0x1a54]
push 0xa000
push eax
call fcn.10007867
mov edi, 0x800
push edi
push 0xffffffffffffffff
push 0x100cf0a0
call fcn.10044b80
push edi
push 0xffffffffffffffff
push 0x1011d3c0
call fcn.10044b80
push edi
push 0xffffffffffffffff
push 0x1014db18
call fcn.10044b80
push edi
mov esi, 0x10168750
push esi
call fcn.10007867
and dword [0x1016814c], 0
and dword [0x10168f50], 0
push 0xa000
lea eax, [esp + 0x1a8c]
push eax
push str.tc_RansomFileType
push ebx
push ebp
call fcn.1004171d
add esp, 0x48
cmp eax, 0xffffffff
jne 0x10012bc2
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
je 0x10012ccb
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10040933
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x10012bf9
push esi
push str.g_tc_RansomFree_Process_:__s
push 0
call fcn.1004122a
add esp, 0xc
push 0x60
push esi
call fcn.10044a60
pop ecx
pop ecx
mov dword [0x1016814c], eax
test eax, eax
je 0x10012c1a
mov byte [eax], 0
mov eax, dword [0x1016814c]
inc eax
mov dword [0x1016814c], eax
push 0x60
push eax
call fcn.10044a60
pop ecx
pop ecx
mov dword [0x10168f50], eax
test eax, eax
je 0x10012c36
mov byte [eax], 0
inc dword [0x10168f50]
push 0x200
push 0x100cf0a0
push 0x3a
push esi
call fcn.10040740
mov eax, dword [0x1016814c]
add esp, 0x10
test eax, eax
je 0x10012c69
push 0x200
push 0x1011d3c0
push 0x3a
push eax
call fcn.10040740
add esp, 0x10
mov eax, dword [0x10168f50]
xor esi, esi
cmp eax, esi
je 0x10012c89
push 0x200
push 0x1014db18
push 0x3a
push eax
call fcn.10040740
add esp, 0x10
cmp dword [0x1015568c], esi
je 0x10012ccb
cmp dword [0x100cf0a0], 0xffffffff
je 0x10012ccb
cmp esi, edi
jge 0x10012ccb
push dword [esi + 0x1014db18]
push dword [esi + 0x1011d3c0]
push dword [esi + 0x100cf0a0]
push str.g_RF_AR_Process__s__g_RF_AR_Ext__s__g_RF_AR_Folder__s_
push 0
call fcn.1004122a
add esi, 4
add esp, 0x14
cmp dword [esi + 0x100cf0a0], 0xffffffff
jne 0x10012c9a
mov esi, 0xa000
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
cmp byte [0x1015062d], 0
pop ecx
pop ecx
mov edi, str.tc_ExceptProcessForm
mov eax, str.tc_ExceptProcessEnable
jne 0x10012cf5
mov eax, edi
push esi
lea ecx, [esp + 0x1a58]
push ecx
push eax
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10012d16
mov byte [esp + 0x1a54], 0
cmp dword [0x1015568c], 0
je 0x10012d47
cmp byte [0x1015062d], 0
mov eax, str.tc_ExceptProcessEnable
jne 0x10012d2f
mov eax, edi
lea ecx, [esp + 0x1a54]
push ecx
push eax
push str.__s_sPath__s_
push 0
call fcn.1004122a
add esp, 0x10
mov esi, 0x1000
push esi
push 0xffffffffffffffff
push 0x101461e0
call fcn.10044b80
push esi
push 0xffffffffffffffff
push 0x100b98a0
call fcn.10044b80
push esi
push 0xffffffffffffffff
push 0x1011dbc0
call fcn.10044b80
mov esi, 0x5000
push esi
mov edi, 0x1015e148
push edi
call fcn.10007867
push esi
push 0x10163148
call fcn.10007867
xor eax, eax
push 0x3ff
push eax
mov dword [0x10168148], eax
mov dword [0x1015ad04], eax
mov byte [esp + 0x1690], al
lea eax, [esp + 0x1691]
push eax
call fcn.10044b80
add esp, 0x40
push 0x400
mov esi, 0x10153168
push esi
call fcn.10007867
push 0x200
push 0x10153568
call fcn.10007867
push 0x200
push 0x10153768
call fcn.10007867
push 0x400
push esi
push 0x10064764
push 0x10154228
call fcn.1000f6a2
add esp, 0x28
test eax, eax
je 0x10012e18
push esi
lea eax, [esp + 0x1658]
push str.:_s:
push eax
call fcn.10044ec8
add esp, 0xc
push 0x200
push 0x10153568
push 0x10064748
push 0x10154228
call fcn.1000f6a2
push 0x200
push 0x10153768
push 0x10064738
push 0x10154228
call fcn.1000f6a2
push esi
call fcn.10044e58
push 0x10153568
call fcn.10044e58
push 0x10153768
call fcn.10044e58
lea eax, [esp + 0x1680]
push eax
call fcn.10044e58
add esp, 0x30
cmp dword [0x1015568c], 0
je 0x10012e97
push 0x10153768
push 0x10153568
push esi
push str.g_sFileDescription__s__g_sOriginalFilename__s__g_sLegalCopyright__s_
push 0
call fcn.1004122a
add esp, 0x14
cmp byte [esp + 0x1a54], 0
je 0x10013504
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10040933
push edi
call fcn.10044e58
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x1015e148]
mov byte [eax + 0x10163148], cl
inc eax
test cl, cl
jne 0x10012ebe
cmp dword [0x1015568c], 0
je 0x10012ee8
push edi
push str.g_tc_ExceptProcess_:__s
push 0
call fcn.1004122a
add esp, 0xc
push 0x60
push edi
call fcn.10044a60
pop ecx
pop ecx
mov dword [0x1015ad04], eax
test eax, eax
je 0x10012f3e
mov byte [eax], 0
inc dword [0x1015ad04]
push 0x60
push dword [0x1015ad04]
call fcn.10044a60
pop ecx
pop ecx
mov ecx, 0x10163148
mov dword [0x10168148], eax
mov esi, eax
sub ecx, eax
mov dl, byte [esi]
mov byte [esi + ecx], dl
inc esi
test dl, dl
jne 0x10012f21
mov esi, 0x200
test eax, eax
je 0x10012f43
mov byte [eax], dl
inc dword [0x10168148]
jmp 0x10012f43
mov esi, 0x200
cmp byte [0x1015062d], 0
push esi
push 0x101461e0
je 0x10012f8a
push 0x3e
push edi
call fcn.10040740
mov eax, dword [0x1015ad04]
add esp, 0x10
test eax, eax
je 0x10012f77
push esi
push 0x100b98a0
push 0x3e
push eax
call fcn.10040740
add esp, 0x10
mov eax, dword [0x10168148]
test eax, eax
je 0x10012fc9
push esi
push 0x1011dbc0
push 0x3e
jmp 0x10012fc0
push 0x3a
push edi
call fcn.10040740
mov eax, dword [0x1015ad04]
add esp, 0x10
test eax, eax
je 0x10012faf
push esi
push 0x100b98a0
push 0x3a
push eax
call fcn.10040740
add esp, 0x10
mov eax, dword [0x10168148]
test eax, eax
je 0x10012fc9
push esi
push 0x1011dbc0
push 0x3a
push eax
call fcn.10040740
add esp, 0x10
xor esi, esi
cmp dword [0x1015568c], esi
je 0x10013033
cmp dword [0x101461e0], 0xffffffff
je 0x10013033
mov edi, 0x10060ec9
cmp esi, 0x400
jge 0x10013033
mov eax, dword [esi*4 + 0x1011dbc0]
cmp eax, 0xffffffff
jne 0x10012ff7
mov eax, edi
mov ecx, dword [esi*4 + 0x100b98a0]
mov edx, ecx
cmp ecx, 0xffffffff
jne 0x10013007
mov edx, edi
mov ecx, dword [esi*4 + 0x101461e0]
cmp ecx, 0xffffffff
jne 0x10013015
mov ecx, edi
push eax
push edx
push ecx
push esi
push str.Except_Log__d__g_tc_AR_EXProcess__s__g_tc_AR_EXProcessIP__s__g_tc_AR_EXFolder__s_
push 0
call fcn.1004122a
add esp, 0x18
inc esi
cmp dword [esi*4 + 0x101461e0], 0xffffffff
jne 0x10012fe1
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add dword [esp + 0x1c], 0x9534e000
lea eax, [esp + 0x2c]
push eax
adc dword [esp + 0x24], 0x64
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x34]
push eax
lea eax, [esp + 0xef8]
push str._04d__02d__02d
push eax
call fcn.10044ec8
and dword [esp + 0x28], 0
add esp, 0x14
cmp dword [0x101461e0], 0xffffffff
je 0x10013504
mov esi, dword [esp + 0x14]
cmp esi, 0x400
jge 0x10013504
mov edi, esi
shl edi, 2
mov eax, dword [edi + 0x101461e0]
cmp byte [eax], 0
je 0x10013172
push eax
push 0x10154628
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10013172
mov eax, dword [edi + 0x1011dbc0]
cmp eax, 0xffffffff
je 0x10013102
test eax, eax
je 0x10013102
cmp byte [eax], 0
je 0x10013102
push eax
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10013172
mov eax, dword [edi + 0x100b98a0]
cmp eax, 0xffffffff
je 0x1001315a
cmp byte [eax], 0
je 0x1001315a
push 0x2d
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
je 0x1001315a
mov esi, dword [edi + 0x100b98a0]
lea eax, [esp + 0xeec]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1001314b
test cl, cl
je 0x10013147
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1001314b
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x1001312d
xor eax, eax
jmp 0x10013150
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001401d
jmp 0x10013172
mov eax, dword [edi + 0x100b98a0]
cmp eax, 0xffffffff
je 0x10013911
cmp byte [eax], 0
je 0x10013911
mov eax, dword [edi + 0x101461e0]
cmp byte [eax], 0x2a
jne 0x1001325a
cmp byte [eax + 1], 0
jne 0x1001325a
mov eax, dword [edi + 0x1011dbc0]
cmp eax, 0xffffffff
je 0x1001325a
cmp byte [eax], 0
je 0x1001325a
push eax
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001325a
mov eax, dword [edi + 0x100b98a0]
cmp eax, 0xffffffff
je 0x10013242
cmp byte [eax], 0
je 0x10013242
push 0x2d
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
je 0x10013242
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
lea eax, [esp + 0x894]
push str._04d__02d__02d
push eax
call fcn.10044ec8
mov esi, dword [edi + 0x100b98a0]
add esp, 0x14
lea eax, [esp + 0x888]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10013233
test cl, cl
je 0x1001322f
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10013233
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x10013215
xor eax, eax
jmp 0x10013238
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001401d
jmp 0x1001325a
mov eax, dword [edi + 0x100b98a0]
cmp eax, 0xffffffff
je 0x1001392c
cmp byte [eax], 0
je 0x1001392c
mov eax, dword [edi + 0x101461e0]
cmp byte [eax], 0x2b
jne 0x10013338
cmp byte [eax + 1], 0
jne 0x10013338
mov eax, dword [edi + 0x1011dbc0]
cmp eax, 0xffffffff
je 0x10013338
cmp byte [eax], 0
je 0x10013338
push eax
mov esi, 0x10153168
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10013338
mov eax, dword [edi + 0x100b98a0]
cmp eax, 0xffffffff
je 0x1001394b
cmp byte [eax], 0
je 0x1001394b
push 0x2d
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
je 0x1001394b
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x7e]
push eax
movzx eax, word [esp + 0x7e]
push eax
movzx eax, word [esp + 0x80]
push eax
lea eax, [esp + 0x894]
push str._04d__02d__02d
push eax
call fcn.10044ec8
mov esi, dword [edi + 0x100b98a0]
add esp, 0x14
lea eax, [esp + 0x888]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1001332b
test cl, cl
je 0x10013327
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1001332b
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x1001330d
xor eax, eax
jmp 0x10013330
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001401d
mov eax, dword [edi + 0x101461e0]
cmp byte [eax], 0x2d
jne 0x10013413
cmp byte [eax + 1], 0
jne 0x10013413
mov eax, dword [edi + 0x1011dbc0]
cmp eax, 0xffffffff
je 0x10013413
cmp byte [eax], 0
je 0x10013413
push eax
mov esi, 0x10153568
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10013413
mov eax, dword [edi + 0x100b98a0]
cmp eax, 0xffffffff
je 0x10013966
cmp byte [eax], 0
je 0x10013966
push 0x2d
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
je 0x10013966
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x6e]
push eax
movzx eax, word [esp + 0x70]
push eax
lea eax, [esp + 0x894]
push str._04d__02d__02d
push eax
call fcn.10044ec8
mov esi, dword [edi + 0x100b98a0]
add esp, 0x14
lea eax, [esp + 0x888]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10013406
test cl, cl
je 0x10013402
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10013406
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x100133e8
xor eax, eax
jmp 0x1001340b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001401d
mov eax, dword [edi + 0x101461e0]
cmp byte [eax], 0x63
jne 0x100134ee
cmp byte [eax + 1], 0
jne 0x100134ee
mov eax, dword [edi + 0x1011dbc0]
cmp eax, 0xffffffff
je 0x100134ee
cmp byte [eax], 0
je 0x100134ee
push eax
mov esi, 0x10153768
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x100134ee
mov eax, dword [edi + 0x100b98a0]
cmp eax, 0xffffffff
je 0x10013981
cmp byte [eax], 0
je 0x10013981
push 0x2d
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
je 0x10013981
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x48]
push eax
lea eax, [esp + 0x894]
push str._04d__02d__02d
push eax
call fcn.10044ec8
mov edi, dword [edi + 0x100b98a0]
add esp, 0x14
lea eax, [esp + 0x888]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x100134e1
test cl, cl
je 0x100134dd
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x100134e1
inc eax
inc eax
inc edi
inc edi
test cl, cl
jne 0x100134c3
xor eax, eax
jmp 0x100134e6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x1001401d
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp dword [eax*4 + 0x101461e0], 0xffffffff
jne 0x100130a4
mov esi, 0xa000
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10007867
push esi
lea eax, [esp + 0x1a60]
push eax
push str.tc_WhiteList
push ebx
push ebp
call fcn.1004171d
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x1001353c
mov byte [esp + 0x1a54], 0
mov esi, 0x800
push esi
or edi, 0xffffffff
push edi
push 0x101123a8
call fcn.10044b80
push esi
push edi
push 0x10147c18
call fcn.10044b80
push esi
push edi
push 0x10148618
call fcn.10044b80
push esi
push edi
push 0x1014d118
call fcn.10044b80
push esi
push edi
push 0x101451d0
call fcn.10044b80
xor eax, eax
push 0x5000
mov edi, 0x10168f58
push edi
mov dword [0x1016df58], eax
mov dword [0x1016df5c], eax
mov dword [0x1016df60], eax
call fcn.10007867
add esp, 0x44
cmp byte [esp + 0x1a54], 0
je 0x100136ec
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10040933
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x100135db
push edi
push str.g_tc_WhiteList_:__s
push 0
call fcn.1004122a
add esp, 0xc
push 0x60
push edi
call fcn.10044a60
pop ecx
pop ecx
mov dword [0x1016df58], eax
test eax, eax
je 0x100135fc
mov byte [eax], 0
mov eax, dword [0x1016df58]
inc eax
mov dword [0x1016df58], eax
push 0x60
push eax
call fcn.10044a60
pop ecx
pop ecx
mov dword [0x1016df5c], eax
test eax, eax
je 0x1001361d
mov byte [eax], 0
mov eax, dword [0x1016df5c]
inc eax
mov dword [0x1016df5c], eax
push 0x60
push eax
call fcn.10044a60
pop ecx
pop ecx
mov dword [0x1016df60], eax
test eax, eax
je 0x10013639
mov byte [eax], 0
inc dword [0x1016df60]
push 0x200
push 0x10147c18
push 0x3a
push edi
call fcn.10040740
mov eax, dword [0x1016df58]
add esp, 0x10
mov edi, 0x200
test eax, eax
je 0x1001366d
push edi
push 0x10148618
push 0x3a
push eax
call fcn.10040740
add esp, 0x10
mov eax, dword [0x1016df5c]
test eax, eax
je 0x10013687
push edi
push 0x1014d118
push 0x3a
push eax
call fcn.10040740
add esp, 0x10
mov eax, dword [0x1016df60]
test eax, eax
je 0x100136a1
push edi
push 0x101451d0
push 0x3a
push eax
call fcn.10040740
add esp, 0x10
cmp dword [0x1015568c], 0
je 0x100136ec
cmp dword [0x10147c18], 0xffffffff
je 0x100136ec
xor edi, edi
cmp edi, esi
jge 0x100136ec
push dword [edi + 0x101451d0]
push dword [edi + 0x1014d118]
push dword [edi + 0x10148618]
push dword [edi + 0x10147c18]
push str.g_WL_arName__s__g_WL_arHash__s__g_WL_arSign__s__g_WL_arFolder__s_
push 0
call fcn.1004122a
add edi, 4
add esp, 0x18
cmp dword [edi + 0x10147c18], 0xffffffff
jne 0x100136b5
push esi
push 0xffffffffffffffff
push 0x10147c18
call fcn.10044b80
push 0x200
push 0x10148418
call fcn.10007867
mov edi, 0xa000
lea eax, [esp + 0x1a68]
push edi
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a74]
push eax
push str.tc_SvrAgentDetectFolder
push ebx
push ebp
call fcn.1004171d
add esp, 0x30
cmp eax, 0xffffffff
jne 0x10013740
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
je 0x10013775
lea eax, [esp + 0x1a54]
push 0x10148418
push eax
call fcn.10040933
push 0x200
push 0x100df1a8
push 0x3a
push 0x10148418
call fcn.10040740
add esp, 0x18
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a60]
push eax
push str.tc_ExceptURL_SRC
push ebx
push ebp
call fcn.1004171d
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x100137a8
mov byte [esp + 0x1a54], 0
push esi
mov esi, 0x1016df68
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10013817
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10040933
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x100137e9
push esi
push str.g_tc_ExceptURL_:__s
push 0
call fcn.1004122a
add esp, 0xc
push esi
mov esi, 0x1015db48
push esi
push str._s:_s
push esi
call fcn.10044ec8
add esp, 0x10
cmp dword [0x1015568c], 0
je 0x10013817
push esi
push str.All_ExceptIP_____s
push 0
call fcn.1004122a
add esp, 0xc
push 0x600
mov esi, 0x1016e768
push esi
call fcn.10007867
lea eax, [esp + 0x1a5c]
push edi
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a68]
push eax
push str.tc_CutExceptIP
push ebx
push ebp
call fcn.1004171d
add esp, 0x24
cmp eax, 0xffffffff
jne 0x1001385a
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
je 0x1001389b
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10040933
push esi
call fcn.10044e58
add esp, 0xc
cmp dword [0x1015568c], 0
je 0x10013894
push esi
push str.g_tc_CutExceptIP_:__s
push 0
call fcn.1004122a
add esp, 0xc
push esi
call fcn.10010fbf
pop ecx
cmp dword [0x1015568c], 0
je 0x100138bb
movzx eax, byte [0x10077497]
push eax
push str.g_bRansomGoGo_1__d_
push 0
call fcn.1004122a
add esp, 0xc
and dword [esp + 0x18], 0
push 1
lea eax, [esp + 0x1c]
push eax
push 0xa1
push str.backupagent
push 4
push 0x10153e28
call fcn.100441ea
mov esi, eax
add esp, 0x18
mov edi, esi
test esi, esi
jne 0x100138ed
mov edi, str.backupagent
cmp byte [edi], 0
je 0x100139e0
test esi, esi
je 0x100139a9
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x100139e0
jmp 0x100139b1
push dword [esi*4 + 0x1011dbc0]
push dword [esi*4 + 0x101461e0]
push 0x10154228
push esi
push str.Except_process__d__g_szMyExeFullPath__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
jmp 0x1001399a
mov eax, dword [esp + 0x14]
push dword [eax*4 + 0x1011dbc0]
push dword [eax*4 + 0x101461e0]
push 0x10154228
push eax
push str.Except_folder__d__g_szMyExeFullPath__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
jmp 0x1001399a
mov eax, dword [esp + 0x14]
push dword [eax*4 + 0x1011dbc0]
push dword [eax*4 + 0x101461e0]
push esi
push eax
push str.Except_FileDescription__d__g_sFileDescription__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
jmp 0x1001399a
mov eax, dword [esp + 0x14]
push dword [eax*4 + 0x1011dbc0]
push dword [eax*4 + 0x101461e0]
push esi
push eax
push str.Except_OriginalFilename__d__g_sOriginalFilename__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
jmp 0x1001399a
mov eax, dword [esp + 0x14]
push dword [eax*4 + 0x1011dbc0]
push dword [eax*4 + 0x101461e0]
push esi
push eax
push str.Except_Copyright__d__g_sLegalCopyright__s__g_tc_AR_EXProcess__s__g_tc_AR_EXFolder__s_
push 0
call fcn.1004122a
add esp, 0x18
jmp 0x1001401d
cmp edi, 0x10064569
ja 0x100139eb
push edi
push 0x10153168
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10013b3d
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100139cb
sub eax, ecx
lea edi, [edi + eax + 1]
test edi, edi
jne 0x100138ed
test esi, esi
je 0x100139eb
push esi
call fcn.100469c3
pop ecx
push 2
lea eax, [esp + 0x1c]
push eax
push 0x9d
mov esi, str.facebookupdate.exe
push esi
push 5
push 0x10153e28
call fcn.100441ea
add esp, 0x18
mov dword [esp + 0x14], eax
mov edi, eax
test eax, eax
jne 0x10013a18
mov edi, esi
cmp byte [edi], 0
je 0x10013a2f
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10013a91
mov ecx, dword [esp + 0x18]
add ecx, eax
cmp edi, ecx
jbe 0x10013a99
cmp dword [esp + 0x14], 0
je 0x10013a40
push dword [esp + 0x14]
call fcn.100469c3
pop ecx
push 1
lea eax, [esp + 0x1c]
push eax
push 0x9c
push 0x100641c0
push 6
push 0x10153e28
call fcn.100441ea
mov esi, eax
add esp, 0x18
mov edi, esi
test esi, esi
jne 0x10013a6d
mov edi, 0x100641c0
cmp byte [edi], 0
je 0x10013b8d
test esi, esi
je 0x10013b51
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013b8d
jmp 0x10013b59
cmp edi, 0x100642fd
ja 0x10013a40
push edi
push 0x10153568
mov byte [esp + 0x1b], 0
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10013ab4
mov byte [esp + 0x13], 1
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013ab9
sub eax, esi
lea edi, [edi + eax + 1]
test edi, edi
je 0x10013a2f
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013ad3
sub eax, edx
je 0x10013a2f
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10013afa
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013a2f
jmp 0x10013b06
cmp edi, 0x100642fd
ja 0x10013a40
cmp byte [esp + 0x13], 0
je 0x10013b1e
push edi
push 0x10153768
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10013b3d
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013b23
sub eax, esi
lea edi, [edi + eax + 1]
test edi, edi
jne 0x10013a18
jmp 0x10013a2f
test esi, esi
je 0x1001401d
push esi
call fcn.100469c3
pop ecx
jmp 0x1001401d
cmp edi, 0x1006425c
ja 0x10013b98
push edi
push 0x10153168
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10013b86
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013b6f
sub eax, ecx
lea edi, [edi + eax + 1]
test edi, edi
jne 0x10013a6d
jmp 0x10013b8d
mov byte [0x10077497], 0
test esi, esi
je 0x10013b98
push esi
call fcn.100469c3
pop ecx
push 1
lea eax, [esp + 0x1c]
push eax
push 3
push 0x100641bc
push 7
push 0x10153e28
call fcn.100441ea
mov esi, eax
add esp, 0x18
mov edi, esi
test esi, esi
jne 0x10013c08
mov edi, 0x100641bc
jmp 0x10013c08
test edi, edi
je 0x10013c1a
cmp byte [edi], 0
je 0x10013c1a
test esi, esi
je 0x10013bdd
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013c1a
jmp 0x10013be5
cmp edi, 0x100641bf
ja 0x10013c25
push edi
push 0x10153768
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10013c13
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013bfb
sub eax, ecx
lea edi, [edi + eax + 1]
cmp byte [0x10077497], 0
jne 0x10013bc4
jmp 0x10013c1a
mov byte [0x10077497], 0
test esi, esi
je 0x10013c25
push esi
call fcn.100469c3
pop ecx
push 2
lea eax, [esp + 0x1c]
push eax
push 3
push 0x100641bc
push 8
push 0x10153e28
call fcn.100441ea
mov esi, eax
add esp, 0x18
mov edi, esi
test esi, esi
jne 0x10013d0c
mov edi, 0x100641bc
jmp 0x10013d0c
test edi, edi
je 0x10013d22
cmp byte [edi], 0
je 0x10013d22
test esi, esi
je 0x10013c7d
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013d22
jmp 0x10013c89
cmp edi, 0x100641bf
ja 0x10013d2d
push edi
push 0x10153568
mov byte [esp + 0x1b], 0
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10013ca4
mov byte [esp + 0x13], 1
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013ca9
sub eax, ecx
lea edi, [edi + eax + 1]
test edi, edi
je 0x10013d22
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013cbf
sub eax, edx
je 0x10013d22
test esi, esi
je 0x10013cda
mov eax, dword [esp + 0x18]
add eax, esi
cmp edi, eax
ja 0x10013d22
jmp 0x10013ce2
cmp edi, 0x100641bf
ja 0x10013d2d
cmp byte [esp + 0x13], 0
je 0x10013cfa
push edi
push 0x10153768
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10013d1b
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10013cff
sub eax, ecx
lea edi, [edi + eax + 1]
cmp byte [0x10077497], 0
jne 0x10013c58
jmp 0x10013d22
mov byte [0x10077497], 0
test esi, esi
je 0x10013d2d
push esi
call fcn.100469c3
pop ecx
test dword [0x1015086c], 0x400
je 0x10013e1d
mov edi, str.process_hacker
cmp byte [edi], 0
je 0x10013e1d
cmp edi, 0x100641bc
jae 0x10013e1d
push edi
mov esi, 0x10153168
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10013e03
call fcn.10030ef2
or byte [0x102d2d93], al
push 0x3ff
lea eax, [esp + 0x8f1]
push 0
push eax
mov byte [esp + 0x8f8], 0
call fcn.10044b80
push esi
lea eax, [esp + 0x8fc]
push str.Behavior_Blocking____Hacking_Tool__s
push eax
call fcn.10044ec8
lea eax, [esp + 0x904]
push 0x7c
push eax
call fcn.10044a60
xor esi, esi
add esp, 0x20
cmp eax, esi
je 0x10013dc2
mov byte [eax], 0x60
lea eax, [esp + 0x8ec]
push 0x7c
push eax
call fcn.10044a60
pop ecx
pop ecx
cmp eax, esi
je 0x10013dda
mov byte [eax], 0x60
push esi
push esi
push esi
lea eax, [esp + 0x8f8]
push eax
push 1
push bind
push 0x100
mov ecx, 0x101acab8
call fcn.10039084
test eax, eax
jne 0x10014018
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013e08
sub eax, esi
lea edi, [edi + eax + 1]
test edi, edi
jne 0x10013d42
cmp dword [0x1015568c], 0
je 0x10013e64
push 0x10153168
push 0x10154228
push str.MyGetFileVersionInformation___s__s_
xor esi, esi
push esi
call fcn.1004122a
push dword [0x10077cd8]
push str.g_isOS__08x_
push esi
call fcn.1004122a
movzx eax, byte [0x10077497]
push eax
push str.g_bRansomGoGo_2__d_
push esi
call fcn.1004122a
add esp, 0x28
mov edi, 0x1400
push edi
mov esi, 0x10181e48
push esi
call fcn.10007867
push edi
mov edi, 0x10183248
push edi
call fcn.10007867
add esp, 0x10
call fcn.1000e5a4
cmp dword [0x1015568c], 0
je 0x10013ea3
push edi
push esi
push str.Get_tc_BlackList_from_BlackFile_:___s__s_
push 0
call fcn.1004122a
add esp, 0x10
mov edi, 0xa000
lea eax, [esp + 0x1a54]
push edi
push eax
call fcn.10007867
lea eax, [esp + 0x10a5c]
push 0x5000
push eax
call fcn.10007867
push edi
lea eax, [esp + 0x1a68]
push eax
push str.tc_BlackList
push ebx
push ebp
call fcn.1004171d
add esp, 0x24
cmp eax, 0xffffffff
jne 0x10013eed
mov byte [esp + 0x1a54], 0
cmp byte [esp + 0x1a54], 0
mov edi, 0x100d98a0
je 0x100140c6
lea eax, [esp + 0x10a54]
push eax
lea eax, [esp + 0x1a58]
push eax
call fcn.10040933
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x10013f37
lea eax, [esp + 0x10a54]
push eax
push str.Get_tc_BlackList_from_regedit_:___s_
push 0
call fcn.1004122a
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x10a54]
mov byte [esp + eax + 0x1a54], cl
inc eax
test cl, cl
jne 0x10013f39
lea eax, [esp + 0x1a54]
push 0x60
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x10014024
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10013f66
mov edi, esi
mov esi, 0x10063740
lea eax, [esp + 0x1a54]
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013f80
mov edi, 0x10181e48
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10013f8f
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x1000
mov ecx, eax
and ecx, 3
push 0xffffffffffffffff
push 0x100d98a0
rep movsb byte es:[edi], byte [esi]
call fcn.10044b80
push 0x200
push 0x100d98a0
lea eax, [esp + 0x1a68]
push 0x3a
push eax
call fcn.10040740
add esp, 0x1c
xor eax, eax
cmp dword [0x100d98a0], 0xffffffff
je 0x10013ff3
mov ecx, 0x100d98a0
cmp ecx, 0x100da0a0
jge 0x10013ff3
add ecx, 4
inc eax
cmp dword [ecx], 0xffffffff
jne 0x10013fe2
test eax, eax
jle 0x100140c6
mov edi, 0x10183248
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014001
dec eax
mov esi, 0x10063740
movsw word es:[edi], word [esi]
jne 0x10013ffb
jmp 0x100140c6
call fcn.1002c8b0
xor al, al
jmp 0x10014cf1
push 0x1000
push 0xffffffffffffffff
push edi
call fcn.10044b80
push 0x200
push edi
lea eax, [esp + 0x1a68]
push 0x60
push eax
call fcn.10040740
mov edi, esi
add esp, 0x1c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1001404c
mov eax, dword [0x100d98a0]
mov edx, 0x10063740
mov esi, edx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014064
mov edi, 0x10181e48
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014073
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x10183248
mov edi, ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10014091
mov eax, dword [0x100d98a4]
mov esi, edx
movsw word es:[edi], word [esi]
mov esi, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100140a4
mov edi, ecx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100140b0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x10181e48
push esi
call fcn.10044e58
mov edi, 0x10183248
push edi
call fcn.10044e58
cmp dword [0x1015568c], 0
pop ecx
pop ecx
je 0x100140f8
push edi
push esi
push str.g_tc_BlackList:___s_g_tc_BlackListVer:___s_
push 0
call fcn.1004122a
add esp, 0x10
cmp byte [0x10181e48], 0
jne 0x10014167
push esi
push 0x10064c14
push esi
call fcn.10044ec8
push edi
push 0x10064c14
push edi
call fcn.10044ec8
add esp, 0x18
cmp byte [0x10181e48], 0
jne 0x10014167
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001412a
sub eax, edx
cmp byte [eax + 0x10181e47], 0x3a
je 0x10014167
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1001413d
mov edi, esi
mov eax, 0x10063740
mov esi, eax
movsw word es:[edi], word [esi]
mov edi, 0x10183248
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014156
mov esi, eax
movsw word es:[edi], word [esi]
mov esi, 0x10181e48
test byte [0x1016ed68], 4
je 0x100146a6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014179
sub eax, edx
cmp eax, 2
jbe 0x100146a6
push str..dll
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001431f
cmp dword [0x10153984], 0
jne 0x100141f4
push str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100141cb
push str.EnumProcessModules
push eax
call edi
mov dword [0x10153984], eax
cmp dword [0x10153984], 0
jne 0x100141f4
push str.EnumProcessModules
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov dword [0x10153984], eax
test eax, eax
je 0x1001431f
push 0x800
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.10044b80
mov edi, 0x1ff
push edi
lea eax, [esp + 0x8fd]
push 0
push eax
mov byte [esp + 0x904], 0
call fcn.10044b80
push edi
xor edi, edi
lea eax, [esp + 0xf6d]
push edi
push eax
mov byte [esp + 0xf74], 0
call fcn.10044b80
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x1c]
push ecx
push 0x800
lea ecx, [esp + 0x90]
push ecx
push eax
mov dword [esp + 0x34], eax
call dword [0x10153984]
cmp eax, edi
je 0x10014315
mov eax, dword [esp + 0x1c]
shr eax, 2
cmp edi, eax
jae 0x10014315
push 0x200
lea eax, [esp + 0x8f0]
push eax
push dword [esp + edi*4 + 0x90]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xf50]
push eax
lea eax, [esp + 0x8f0]
push eax
call fcn.10040337
lea eax, [esp + 0xf58]
push eax
call fcn.10044e58
lea eax, [esp + 0xf5c]
push str..dll
push eax
call fcn.10044fa0
add esp, 0x14
test eax, eax
je 0x100142ee
cmp byte [esp + 0xf50], 0
je 0x100142ee
lea eax, [esp + 0xf50]
push eax
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100142f4
inc edi
jmp 0x1001426c
cmp dword [0x1015568c], 0
je 0x10014315
push esi
lea eax, [esp + 0xf54]
push eax
push str.g_tc_BlackList_Found_Module___s__in_Apps__s_
push 0
call fcn.1004122a
add esp, 0x10
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x10153168], 0
je 0x10014350
lea eax, [esp + 0x1654]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014332
sub eax, edx
cmp eax, 3
jbe 0x10014350
lea eax, [esp + 0x1654]
push eax
push esi
call fcn.10044fa0
pop ecx
pop ecx
push 0x1000
push 0xffffffffffffffff
mov edi, 0x100d98a0
push edi
call fcn.10044b80
add esp, 0xc
cmp byte [0x10181e48], 0
je 0x1001437f
push 0x200
push edi
push 0x3a
push esi
call fcn.10040740
add esp, 0x10
push 0x1000
push 0xffffffffffffffff
mov esi, 0x101441d0
push esi
call fcn.10044b80
add esp, 0xc
cmp byte [0x10183248], 0
mov edi, 0x200
je 0x100143b3
push edi
push esi
push 0x3a
push 0x10183248
call fcn.10040740
add esp, 0x10
xor esi, esi
cmp dword [0x1015568c], esi
je 0x1001441d
cmp dword [0x100d98a0], 0xffffffff
je 0x100143ec
cmp esi, edi
jge 0x100143ec
push dword [esi*4 + 0x100d98a0]
push esi
push str.m_sBlackList_member__d___s_
push 0
call fcn.1004122a
add esp, 0x10
inc esi
cmp dword [esi*4 + 0x100d98a0], 0xffffffff
jne 0x100143c6
xor esi, esi
cmp dword [0x101441d0], 0xffffffff
je 0x1001441d
cmp esi, edi
jge 0x1001441d
push dword [esi*4 + 0x101441d0]
push esi
push str.m_sBlackListVer_member__d___s_
push 0
call fcn.1004122a
add esp, 0x10
inc esi
cmp dword [esi*4 + 0x101441d0], 0xffffffff
jne 0x100143f7
push 0x104
lea eax, [esp + 0xcf0]
push 0
push eax
call fcn.10044b80
add esp, 0xc
xor eax, eax
mov byte [esp + 0x1654], 0
mov dl, 1
or esi, 0xffffffff
mov ecx, dword [eax + 0x100d98a0]
cmp ecx, esi
jne 0x10014459
cmp dword [eax + 0x101441d0], esi
je 0x1001446d
cmp ecx, esi
je 0x10014461
cmp dword [eax + 0x101441d0], esi
jne 0x10014463
xor dl, dl
add eax, 4
cmp eax, 0x800
jl 0x10014443
xor edi, edi
test dl, dl
je 0x100146a6
mov esi, edi
shl esi, 2
mov eax, dword [esi + 0x100d98a0]
cmp eax, 0xffffffff
je 0x100146a6
cmp edi, 0x200
jge 0x100146a6
cmp dword [0x1015568c], 0
mov byte [esp + 0xcec], 0
je 0x100144be
push 0x10154428
push eax
push edi
push str.__d_loop_g_tc_BlackList_Split_found____s_in_Apps__s__
push 0
call fcn.1004122a
add esp, 0x14
mov ecx, dword [esi + 0x100d98a0]
mov eax, ecx
lea edx, [eax + 1]
mov dword [esp + 0x1c], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100144cd
sub eax, dword [esp + 0x1c]
cmp eax, 2
jbe 0x100145ca
push 0x400
push 0x10184650
push str.tc_Proc_OK
push ebx
push ebp
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x100146cb
mov byte [0x10184650], 0
push 1
push str.tc_CUT_LOG_SEND_SERVER
push str.SOFTWARE_trueEPTC_Env_tc_COMMUNICATION
push ebp
call fcn.10040c17
push 0xa000
mov dword [0x10077cc8], eax
lea eax, [esp + 0x1a68]
push eax
push str.tc_USBExpList
push ebx
push ebp
call fcn.1004171d
add esp, 0x24
cmp eax, 0xffffffff
jne 0x1001470b
mov byte [esp + 0x1a54], 0
push 0x1000
mov esi, 0x10180e48
push esi
call fcn.10007867
cmp byte [esp + 0x1a5c], 0
pop ecx
pop ecx
je 0x10014752
lea eax, [esp + 0x1a54]
push esi
push eax
call fcn.10040933
xor edi, edi
pop ecx
pop ecx
cmp dword [0x1015568c], edi
je 0x10014754
push esi
push str.g_tc_USBExpList___s_
push edi
call fcn.1004122a
add esp, 0xc
jmp 0x10014754
xor edi, edi
cmp byte [0x10156889], 0
je 0x1001477c
push str._tc_Per_is_Personal_setting_on_public_
push edi
mov dword [0x10156890], edi
mov dword [0x1015687c], edi
mov dword [0x10156878], edi
call fcn.1004122a
pop ecx
pop ecx
cmp dword [0x10151cdc], 0x10000
mov byte [0x10077cb8], 0
jae 0x100147aa
cmp dword [0x101570b8], edi
jne 0x100147aa
push 0x1b
push 0x102e0000
call fcn.10007867
pop ecx
pop ecx
call sym.AF_AD.DLL_FDrv
call fcn.1002d448
push 0x10154428
call fcn.1002fd8f
pop ecx
mov byte [0x10150897], al
test al, al
je 0x100147ca
mov byte [0x10077497], 0
test dword [0x10156880], 0x80000000
jne 0x10014abf
test dword [0x1015686c], 0x1000000
mov edi, 0x10063cf8
mov ebp, 0x10151ad8
je 0x10014808
cmp byte [0x10077497], 0
je 0x10014808
test al, al
je 0x10014b4c
mov byte [0x10077497], 0
mov ebx, 0x3ff
mov esi, 0x10060ec9
test dword [0x10077cd0], 0x80000
je 0x100149c4
test dword [0x10156880], 0x80000000
jne 0x100149c4
cmp byte [0x10077497], 0
je 0x10014abf
push 0x10155e68
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100149c4
cmp dword [0x10151cdc], 0x10000
jae 0x100149c4
cmp byte [0x1015688a], al
jne 0x100149c4
cmp byte [0x10150897], al
jne 0x100149c4
cmp byte [0x10151ad8], al
jne 0x10014917
cmp byte [0x10077497], 0
je 0x10014abf
cmp dword [0x10151cdc], 0x10000
jae 0x10014abf
test dword [0x10150864], 0x2000000
je 0x10014abf
cmp byte [0x10151ad8], 0
jne 0x10014a8b
push ebx
lea eax, [esp + 0xf55]
push 0
push eax
mov byte [esp + 0xf5c], 0
call fcn.10044b80
push ebx
lea eax, [esp + 0x8fd]
push 0
push eax
mov byte [esp + 0x904], 0
call fcn.10044b80
push esi
push 0x100627e4
lea eax, [esp + 0x90c]
push eax
push 0x10154228
call fcn.100401a1
push esi
push 0x100639e0
lea eax, [esp + 0xf80]
push eax
lea eax, [esp + 0x920]
push eax
call fcn.100401a1
push esi
push edi
lea eax, [esp + 0x92c]
push eax
lea eax, [esp + 0xf94]
push eax
call fcn.100401a1
add esp, 0x48
lea eax, [esp + 0x8ec]
push ebp
push eax
call fcn.1002ccc4
pop ecx
pop ecx
push ebp
push str.g_szSign_:__s
push 0
call fcn.1004122a
add esp, 0xc
cmp byte [0x10151ad8], 0
je 0x10014abf
mov eax, dword [0x102b4a3c]
cmp eax, 5
je 0x10014abf
cmp eax, 7
je 0x10014abf
test dword [0x1015686c], 0x4000000
mov byte [0x1015062c], 0
je 0x10014af7
push 0x10154628
push str.explorer.exeiexplore.exechrome.exewhale.exeswing.exeoutlook.exealzip.exebandizip.exebreadzip.exe7z.exewinrar.exewinzip.exewlmail.exemsimn.exemicrosoftedge.exemicrosoftedgecp.exefirefox.exeopera.exesafari.exewebkit2webprocess.exewscript.execscript.execonhost.execmd.exepowershell.exepowershell_ise.exeucbrowser.exespark.exe
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10014af7
cmp byte [0x1015688a], 0
jne 0x10014af7
mov byte [0x1015062c], 1
test byte [0x10156880], 0x10
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
jne 0x10014c96
cmp dword [0x10151cdc], 0x10
jae 0x10014c96
xor edi, edi
mov byte [0x10150888], 0
cmp dword [0x10150880], edi
jne 0x10014cab
lea eax, [esp + 0x3c]
push eax
push edi
push edi
push 0x1000e4fc
push edi
push edi
call fcn.1004547d
add esp, 0x18
mov dword [0x10150880], eax
jmp 0x10014cab
cmp byte [0x10151ad8], 0
mov ebx, 0x3ff
jne 0x10014bf2
push ebx
lea eax, [esp + 0xf55]
push 0
push eax
mov byte [esp + 0xf5c], 0
call fcn.10044b80
push ebx
lea eax, [esp + 0x8fd]
push 0
push eax
mov byte [esp + 0x904], 0
call fcn.10044b80
mov esi, 0x10060ec9
push esi
push 0x100627e4
lea eax, [esp + 0x90c]
push eax
push 0x10154228
call fcn.100401a1
push esi
push 0x100639e0
lea eax, [esp + 0xf80]
push eax
lea eax, [esp + 0x920]
push eax
call fcn.100401a1
push esi
push edi
lea eax, [esp + 0x92c]
push eax
lea eax, [esp + 0xf94]
push eax
call fcn.100401a1
add esp, 0x48
lea eax, [esp + 0x8ec]
push ebp
push eax
call fcn.1002ccc4
pop ecx
pop ecx
jmp 0x10014bf7
mov esi, 0x10060ec9
push 0x10063e3c
push ebp
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10014c83
push str.bandisoft
push ebp
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10014c83
push 0x10063e28
push ebp
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10014c83
push str.hancom
push ebp
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10014c83
push 0x10063e18
push ebp
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10014c83
mov byte [0x10077497], 0
mov byte [0x10150897], 1
jmp 0x10014812
mov eax, dword [0x10150880]
xor edi, edi
cmp eax, edi
je 0x10014cab
push edi
push eax
call esi
mov dword [0x10150880], edi
test dword [0x1015686c], 0x40000000
jne 0x10014cdc
cmp dword [0x1015087c], edi
jne 0x10014cef
lea eax, [esp + 0x3c]
push eax
push edi
push edi
push 0x1000da2f
push edi
push edi
call fcn.1004547d
add esp, 0x18
mov dword [0x1015087c], eax
jmp 0x10014cef
mov eax, dword [0x1015087c]
cmp eax, edi
je 0x10014cef
push edi
push eax
call esi
mov dword [0x1015087c], edi
mov al, 1
pop ebp
pop ebx
mov ecx, dword [esp + 0x15a4c]
pop edi
pop esi
xor ecx, esp
call fcn.10044b6f
add esp, 0x15a48
ret