Function at 0x1003921b
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x6944]
mov eax, 0x69c4
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x6940], eax
mov eax, dword [ebp + 0x6958]
push ebx
push esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x6960]
push edi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x6964]
mov dword [ebp - 0x64], ecx
mov ebx, 0x10155628
push 0x18
mov dword [ebp - 0x70], eax
mov edi, str.bitlockerwizardelev.exe
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov byte [ebp - 0x55], 0
mov edx, 0x8000000
je 0x1003962a
mov ecx, dword [0x1015186c]
cmp byte [0x10151897], al
je 0x1003929d
test edx, ecx
je 0x100396bd
mov byte [ebp - 0x55], 1
cmp byte [0x102d3d91], al
jne 0x100392bd
cmp dword [0x100784a8], 0x1f2e3d4c
jne 0x100392bd
test edx, ecx
je 0x100396bd
mov byte [ebp - 0x55], 1
cmp byte [0x10078497], al
jne 0x100392d1
test edx, ecx
je 0x100396bd
mov byte [ebp - 0x55], 1
cmp dword [0x101580c4], eax
je 0x100392e5
test edx, ecx
je 0x100396bd
mov byte [ebp - 0x55], 1
cmp dword [0x101580c8], eax
je 0x100392fb
and dword [0x101580c8], eax
cmp byte [0x102d3d91], al
je 0x10039325
cmp byte [ebp - 0x55], al
jne 0x10039331
test dword [0x1015786c], 0x2000000
je 0x10039331
mov eax, dword [0x102b5a3c]
cmp eax, 5
je 0x10039325
cmp eax, 7
je 0x10039325
cmp eax, 8
je 0x10039325
cmp eax, 6
jne 0x10039331
test edx, ecx
je 0x100396bd
mov byte [ebp - 0x55], 1
mov edi, dword [ebp - 0x60]
push 0x7c
push edi
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
je 0x10039345
mov byte [eax], 0
push 0x1006f998
push edi
call esi
test eax, eax
jne 0x100396bd
push 0x1006b5f0
push ebx
call fcn.10007795
pop ecx
pop ecx
test eax, eax
jne 0x10039376
push str.programdata
push edi
call esi
test eax, eax
jne 0x100396bd
test dword [ebp + 0x694c], 0x100
je 0x100393c5
cmp dword [0x102bfd64], 0
jne 0x100393c5
test dword [0x101580d8], 0x40000
jne 0x100393c5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub esi, dword [0x101580cc]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x101580c4]
mov ecx, 0x2710
test eax, eax
je 0x10039675
cmp esi, ecx
jb 0x10039681
cmp byte [ebp - 0x55], 0
jne 0x1003962a
push str.IE_Exploit_Magniber_RansomWare
push edi
call fcn.1004c839
pop ecx
pop ecx
test eax, eax
jne 0x1003962a
mov ebx, 0x1400
push ebx
xor edi, edi
lea eax, [ebp + 0x3b34]
push edi
push eax
call fcn.10045030
mov esi, 0x200
push esi
lea eax, [ebp + 0x6538]
push edi
push eax
call fcn.10045030
push esi
lea eax, [ebp + 0x5538]
push edi
push eax
call fcn.10045030
push esi
lea eax, [ebp + 0x6138]
push edi
push eax
call fcn.10045030
push ebx
lea eax, [ebp + 0x3b34]
push eax
mov ebx, str.tc_ExOKURL
push ebx
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
call fcn.100417d5
add esp, 0x44
cmp eax, 0xffffffff
jne 0x10039454
mov byte [ebp + 0x3b34], 0
push esi
lea eax, [ebp + 0x6538]
push edi
push eax
call fcn.10045030
add esp, 0xc
cmp byte [0x10151cd0], 0
je 0x100394b7
xor eax, eax
mov cl, byte [eax + 0x10151cd0]
mov byte [ebp + eax + 0x6538], cl
inc eax
test cl, cl
jne 0x10039470
lea eax, [ebp + 0x6538]
push 0x2f
push eax
call fcn.10044f10
pop ecx
pop ecx
cmp eax, edi
je 0x100394b7
inc eax
push 0x2f
push eax
call fcn.10044f10
pop ecx
pop ecx
cmp eax, edi
je 0x100394b7
inc eax
push 0x2f
push eax
call fcn.10044f10
pop ecx
pop ecx
cmp eax, edi
je 0x100394b7
mov byte [eax], 0
cmp byte [ebp + 0x3b34], 0
je 0x100394f6
cmp byte [ebp + 0x6538], 0
je 0x100394f6
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x3b34]
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100394f6
test dword [0x1015186c], 0x8000000
je 0x100396bd
mov byte [ebp - 0x55], 1
push esi
lea eax, [ebp + 0x5538]
push eax
push 0x90
push dword [0x102d3d9c]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x5538]
push eax
lea eax, [ebp + 0x6138]
push eax
call fcn.10045378
add esp, 0xc
cmp byte [ebp - 0x55], 0
jne 0x1003962a
push 4
push str.Warning
lea eax, [ebp + 0x6138]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x1003962a
push 0x1400
lea eax, [ebp + 0x3b34]
push eax
push ebx
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
call fcn.100417d5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10039580
mov byte [ebp + 0x3b34], 0
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x3b34]
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100395f9
lea edi, [ebp + 0x3b34]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100395a0
mov esi, 0x10065940
lea eax, [ebp + 0x6538]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100395b7
lea edi, [ebp + 0x3b34]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100395c7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp + 0x3b34]
push eax
push ebx
and ecx, 3
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
rep movsb byte es:[edi], byte [esi]
call fcn.100422d1
add esp, 0x10
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x3b34]
push eax
push str.found_IE_Exploit_Magniber_RansomWare_ExceptURL__s_url__s_
push 0
call fcn.100412e2
add esp, 0x10
test dword [0x1015186c], 0x8000000
je 0x100396bd
mov byte [ebp - 0x55], 1
mov eax, dword [ebp + 0x6954]
or eax, 0x400
mov dword [ebp - 0x5c], eax
mov eax, dword [0x1015668c]
mov ebx, 0x88
cmp eax, ebx
je 0x10039650
cmp eax, 0x44
je 0x10039650
cmp eax, 4
jne 0x100396c4
mov esi, dword [ebp - 0x60]
push esi
push dword [0x1015787c]
xor edi, edi
push dword [ebp - 0x5c]
push dword [ebp + 0x6950]
push str.SendInfoDisplayRansom_0__08x__08x__08x__s
push edi
call fcn.100412e2
add esp, 0x18
jmp 0x100396c9
cmp esi, 0x7d0
jae 0x100393c5
test eax, eax
je 0x10039691
sub dword [0x101580cc], 0xbb8
jmp 0x10039697
sub dword [0x101580cc], ecx
mov eax, dword [0x1015668c]
cmp eax, 0x88
je 0x100396ad
cmp eax, 0x44
je 0x100396ad
cmp eax, 4
jne 0x100396bd
push esi
push str.SendInfoDisplayRansom_cancel__d_
push 0
call fcn.100412e2
add esp, 0xc
xor eax, eax
jmp 0x1003a283
mov esi, dword [ebp - 0x60]
xor edi, edi
cmp byte [ebp - 0x55], 0
jne 0x10039708
test byte [ebp + 0x6954], 1
jne 0x10039708
push 0x1006b248
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10039708
push 0x10063a4c
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10039708
test dword [0x1015186c], 0x8000000
je 0x100396bd
mov byte [ebp - 0x55], 1
mov eax, dword [0x1015668c]
cmp eax, ebx
je 0x10039716
cmp eax, 0x44
jne 0x10039734
push esi
push dword [0x1015787c]
push dword [ebp - 0x5c]
push dword [ebp + 0x6950]
push str.SendInfoDisplayRansom_1__08x__08x__08x__s
push edi
call fcn.100412e2
add esp, 0x18
push 0x10063d68
push esi
mov dword [ebp - 0x6c], esi
call fcn.10045450
pop ecx
pop ecx
cmp esi, eax
jne 0x1003974e
add esi, 4
mov dword [ebp - 0x6c], esi
cmp byte [ebp - 0x55], 0
mov esi, 0x20000000
jne 0x10039795
cmp byte [0x10154969], 0
jne 0x1003979e
test dword [0x101580d8], esi
je 0x100397b6
push 0x10155228
call fcn.1001daf0
mov byte [0x10154969], al
mov eax, dword [0x1015668c]
pop ecx
cmp eax, ebx
je 0x10039788
cmp eax, 0x44
jne 0x10039795
push str.SendInfoDisplayRansom_g_bSetUpExe_chk
push edi
call fcn.100412e2
pop ecx
pop ecx
cmp byte [0x10154969], 0
je 0x100397b6
mov eax, dword [0x1015186c]
test esi, eax
jne 0x100397b6
test eax, 0x8000000
je 0x100396bd
mov byte [ebp - 0x55], 1
test dword [0x10078cc8], 0x100000
je 0x100397fa
push edi
push str.tc_NO_CON_RANSOM_NO_CUT
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
call fcn.10040ccf
mov dword [0x102b55c4], eax
mov eax, dword [0x1015668c]
add esp, 0x10
cmp eax, ebx
je 0x100397ed
cmp eax, 0x44
jne 0x100397fa
push str.SendInfoDisplayRansom_g_tc_NO_CON_RANSOM_NO_CUT
push edi
call fcn.100412e2
pop ecx
pop ecx
test dword [0x10151864], 0x400
jne 0x1003980f
cmp dword [0x10157874], 2
jne 0x1003983f
mov eax, dword [0x1015668c]
or dword [0x10151cb0], 0x10
mov dword [ebp - 0x5c], 0x42
mov byte [0x10078497], 0
cmp eax, ebx
je 0x10039832
cmp eax, 0x44
jne 0x1003983f
push str.SendInfoDisplayRansom_TC_OPTION1_RANSOM_COM
push edi
call fcn.100412e2
pop ecx
pop ecx
cmp dword [0x102b55c4], edi
jne 0x10039873
cmp byte [0x10154969], 0
jne 0x10039873
cmp byte [ebp - 0x55], 0
jne 0x10039873
cmp byte [0x1015cb48], 0
je 0x10039895
push 0x10155a28
push 0x1015cb48
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10039895
mov eax, dword [0x1015668c]
mov dword [ebp - 0x5c], 0x40042
cmp eax, ebx
je 0x10039888
cmp eax, 0x44
jne 0x10039895
push str.SendInfoDisplayRansom_bShowDetect_OK
push edi
call fcn.100412e2
pop ecx
pop ecx
push 0x18
mov edi, str.bitlockerwizardelev.exe
mov esi, 0x10155628
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x100398ec
mov eax, dword [0x1015668c]
cmp eax, ebx
je 0x100398b6
cmp eax, 0x44
jne 0x100398d7
push dword [ebp - 0x60]
push dword [0x1015787c]
push dword [ebp - 0x5c]
push dword [ebp + 0x6950]
push str.SendInfoDisplayRansom_bitlockerwizardelev__08x__08x__08x__s
push 0
call fcn.100412e2
add esp, 0x18
mov eax, dword [0x10151868]
and eax, 0x400000
neg eax
sbb eax, eax
and eax, 0x41
inc eax
mov dword [ebp - 0x5c], eax
or dword [ebp - 0x5c], 0x400
test byte [ebp - 0x5c], 0x40
je 0x10039924
cmp dword [0x102b55b4], 0
je 0x10039919
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x102b55b4]
cmp eax, 0x5265c00
jbe 0x100396bd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102b55b4], eax
push dword [ebp - 0x6c]
call fcn.10010979
pop ecx
test eax, eax
je 0x1003994e
mov esi, dword [ebp - 0x5c]
and esi, 1
je 0x10039947
test byte [ebp + 0x694c], 4
je 0x10039947
call fcn.1002ca33
mov eax, esi
jmp 0x1003a283
mov ebx, 0x200
push ebx
xor edi, edi
lea eax, [ebp + 0x5338]
push edi
push eax
call fcn.10045030
mov eax, dword [0x1015185c]
add eax, 0xea60
push eax
mov esi, 0x10061188
lea eax, [ebp + 0x5338]
push esi
push eax
call fcn.10045378
push ebx
lea eax, [ebp + 0x5738]
push edi
push eax
call fcn.10045030
push ebx
lea eax, [ebp + 0x6738]
push edi
push eax
call fcn.10045030
push ebx
lea eax, [ebp + 0x5938]
push edi
push eax
call fcn.10045030
push 0x1388
lea eax, [ebp + 0x13ac]
push edi
push eax
call fcn.10045030
add esp, 0x48
push 0x1400
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.10045030
push 0x1400
lea eax, [ebp + 0x2734]
push edi
push eax
call fcn.10045030
mov eax, dword [0x102b5a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x5738]
push str.SoftWareTrojanCut_tc_Files
push eax
mov edi, edx
add edi, 0x64
inc dword [0x102b5a40]
mov dword [ebp - 0x74], edi
call fcn.10045378
push edi
lea eax, [ebp + 0x5938]
push esi
push eax
call fcn.10045378
lea eax, [ebp + 0x6738]
push eax
call fcn.10040f13
lea eax, [ebp + 0x6738]
push eax
call fcn.10038534
push ebx
xor esi, esi
lea eax, [ebp + 0x6338]
push esi
push eax
call fcn.10045030
add esp, 0x40
lea eax, [ebp - 0x80]
push eax
call fcn.100457db
lea eax, [ebp - 0x80]
push eax
call fcn.100457b4
pop ecx
pop ecx
cmp eax, esi
je 0x10039a75
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x6338]
push ebx
push eax
call fcn.10046465
add esp, 0x10
jmp 0x10039a88
lea eax, [ebp + 0x6338]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
push 0x401
lea eax, [ebp + 0x4f34]
push esi
push eax
call fcn.10045030
add esp, 0xc
test dword [0x10078cc0], 0x2000
je 0x10039ac1
cmp dword [ebp - 0x68], esi
je 0x10039ac1
push ebx
lea eax, [ebp + 0x4f34]
push eax
push dword [ebp - 0x68]
call fcn.1004095f
add esp, 0xc
xor eax, eax
lea edi, [ebp + 0x6938]
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x694c]
test al, 8
je 0x10039adc
mov esi, str.L__
jmp 0x10039b1a
test eax, 0x100
je 0x10039aea
mov esi, str.O__
jmp 0x10039b1a
test ebx, eax
je 0x10039af5
mov esi, str.D__
jmp 0x10039b1a
test al, 4
je 0x10039b00
mov esi, str.B__
jmp 0x10039b1a
test eax, 0x1000
je 0x10039b0e
mov esi, str.F__
jmp 0x10039b1a
test eax, 0x2000
je 0x10039b22
mov esi, str.K__
lea edi, [ebp + 0x6938]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x5c]
and eax, 1
mov dword [ebp - 0x60], eax
je 0x10039d97
test byte [0x10078cc8], 2
je 0x10039d97
mov esi, 0x1400
push esi
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.10045030
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.100338b5
mov eax, dword [0x1015668c]
mov esi, 0x88
add esp, 0x14
cmp eax, esi
je 0x10039b6f
cmp eax, 0x44
jne 0x10039b7d
push str.GetDLLStacks_end
push 0
call fcn.100412e2
pop ecx
pop ecx
cmp byte [ebp - 0x54], 0
je 0x10039bb2
cmp dword [0x102b5a3c], 7
jne 0x10039bb2
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.createsoftwareinventory
lea eax, [ebp - 0x54]
push eax
call edi
test eax, eax
je 0x10039bb8
test dword [0x1015186c], 0x8000000
jne 0x10039bb8
jmp 0x100396bd
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x10039bc6
cmp eax, 0x44
jne 0x10039bd4
push str.SendInfoDisplayRansom_disp_6
push 0
call fcn.100412e2
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x6538]
push 0
push eax
call fcn.10045030
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x6738]
push eax
call fcn.10040e29
mov eax, dword [0x1015668c]
add esp, 0x14
cmp eax, esi
je 0x10039c07
cmp eax, 0x44
jne 0x10039c15
push str.SendInfoDisplayRansom_disp_66
push 0
call fcn.100412e2
pop ecx
pop ecx
cmp byte [0x102b5630], 0
je 0x10039c32
xor eax, eax
mov cl, byte [eax + 0x102b5630]
mov byte [ebp + eax + 0x6738], cl
inc eax
test cl, cl
jne 0x10039c20
push str.rundll32.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039cba
push str.dllhost.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039cba
push str.svchost.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039cba
push str.msiexec.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039cba
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x6738]
push eax
call fcn.1000770a
pop ecx
push eax
lea eax, [ebp + 0x6738]
push eax
lea eax, [ebp + 0x6938]
push eax
lea eax, [ebp + 0x2734]
push str._s_s__d__s__s
push eax
call fcn.10045378
add esp, 0x1c
jmp 0x10039d79
push 0x400
lea eax, [ebp + 0x5f38]
push 0
push eax
call fcn.10045030
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp + 0x5f38]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x10039cdc
lea eax, [ebp + 0x5f38]
push 0x20
push eax
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x10039d02
lea eax, [ebp + 0x5f38]
jmp 0x10039d03
inc eax
mov ecx, eax
xor esi, esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10039d0a
sub ecx, edi
je 0x10039d32
cmp byte [esi + eax], 0x7c
jne 0x10039d1f
mov byte [esi + eax], 0x5f
mov ecx, eax
inc esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10039d25
sub ecx, edi
cmp esi, ecx
jb 0x10039d15
lea ecx, [ebp - 0x54]
push ecx
push eax
lea eax, [ebp + 0x6538]
push eax
lea eax, [ebp + 0x6738]
push eax
call fcn.1000770a
pop ecx
push eax
lea eax, [ebp + 0x6738]
push eax
lea eax, [ebp + 0x6938]
push eax
lea eax, [ebp + 0x2734]
push str._s_s__d__s__s_0___s
push eax
call fcn.10045378
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 0x20
mov esi, 0x88
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x10039d87
cmp eax, 0x44
jne 0x10039de1
push str.SendInfoDisplayRansom_disp_666
push 0
call fcn.100412e2
pop ecx
pop ecx
jmp 0x10039de1
cmp byte [0x102b5630], 0
je 0x10039db4
xor eax, eax
mov cl, byte [eax + 0x102b5630]
mov byte [ebp + eax + 0x6738], cl
inc eax
test cl, cl
jne 0x10039da2
lea eax, [ebp + 0x6738]
push eax
lea eax, [ebp + 0x6938]
push eax
lea eax, [ebp + 0x2734]
push 0x10062cb4
push eax
call fcn.10045378
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 0x10
mov esi, 0x88
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x10039def
cmp eax, 0x44
jne 0x10039e05
lea eax, [ebp + 0x2734]
push eax
push str._tSendInfoDisplayRansom_:__s
push 0
call fcn.100412e2
add esp, 0xc
lea eax, [ebp + 0x2734]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10039e0e
sub eax, edx
cmp eax, 0x1400
jbe 0x10039e24
mov byte [ebp + 0x3b33], cl
mov ebx, dword [ebp - 0x6c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10039e2c
sub eax, edx
jne 0x10039e47
test dword [0x1015186c], 0x8000000
je 0x100396bd
push 0x3ff
xor esi, esi
lea eax, [ebp + 0x5b39]
push esi
push eax
mov byte [ebp + 0x5b38], 0
call fcn.10045030
lea edx, [ebp + 0x5b38]
add esp, 0xc
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10039e6f
push str.rundll32.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039f5c
push str.dllhost.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039f5c
push str.svchost.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039f5c
push str.msiexec.exe
lea eax, [ebp + 0x6738]
push eax
call edi
test eax, eax
jne 0x10039f5c
cmp byte [0x102d3d91], al
jne 0x10039eec
cmp dword [0x100784a8], 0x1f2e3d4c
jne 0x10039eec
mov eax, str._User_Behavior_
jmp 0x10039f2d
cmp dword [0x102b55c4], esi
je 0x10039efb
mov eax, str._Disconnected_Manager_
jmp 0x10039f2d
cmp byte [0x10154969], 0
je 0x10039f0b
mov eax, str._Setup_
jmp 0x10039f2d
cmp byte [0x10151897], 0
je 0x10039f1b
mov eax, str._MS_Process_
jmp 0x10039f2d
cmp byte [0x102b562f], 0
je 0x10039ff9
mov eax, str._Process_Title_
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10039f2f
lea edi, [ebp + 0x5b38]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10039f3f
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10039ff9
push 0x400
lea eax, [ebp + 0x5f38]
push esi
push eax
call fcn.10045030
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp + 0x5f38]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x10039f7d
lea eax, [ebp + 0x5f38]
push 0x20
push eax
call fcn.10044f10
pop ecx
pop ecx
cmp eax, esi
jne 0x10039fa3
lea eax, [ebp + 0x5f38]
jmp 0x10039fa4
inc eax
mov ecx, eax
xor esi, esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10039fab
sub ecx, edi
je 0x10039fd3
cmp byte [esi + eax], 0x7c
jne 0x10039fc0
mov byte [esi + eax], 0x5f
mov ecx, eax
inc esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10039fc6
sub ecx, edi
cmp esi, ecx
jb 0x10039fb6
cmp byte [0x10154969], 0
push eax
push ebx
lea eax, [ebp + 0x5b38]
je 0x10039feb
push str._s__s__setup_
jmp 0x10039ff0
push str._s__s
push eax
call fcn.10045378
add esp, 0x10
test byte [0x10151868], 1
je 0x1003a079
test dword [0x10078cc0], 0x2000
je 0x1003a01a
cmp dword [ebp - 0x68], 0
lea ecx, [ebp + 0x4f34]
jne 0x1003a01f
mov ecx, 0x10060ec9
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x1003a02c
mov eax, dword [ebp - 0x64]
add eax, 0x58
push 0x1014e918
push ecx
push dword [ebp + 0x6950]
mov ecx, dword [ebp - 0x64]
push dword [ecx + 0x8b2c]
push eax
push dword [ebp + 0x695c]
lea eax, [ebp + 0x5b38]
push eax
lea eax, [ebp + 0x2734]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x6338]
push eax
lea eax, [ebp + 0x13ac]
push str._s_d_s_s_d_s_d_d_s_s
push eax
call fcn.10045378
add esp, 0x30
jmp 0x1003a0fa
test dword [0x10078cc0], 0x2000
je 0x1003a0a6
cmp dword [ebp - 0x68], 0
lea ecx, [ebp + 0x4f34]
jne 0x1003a096
mov ecx, 0x10060ec9
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x1003a0a3
mov eax, dword [ebp - 0x64]
add eax, 0x58
push ecx
jmp 0x1003a0b8
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x1003a0b3
mov eax, dword [ebp - 0x64]
add eax, 0x58
push 0x10060ec9
push dword [ebp + 0x6950]
mov ecx, dword [ebp - 0x64]
push dword [ecx + 0x8b2c]
push eax
push dword [ebp + 0x695c]
lea eax, [ebp + 0x5b38]
push eax
lea eax, [ebp + 0x2734]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp + 0x6338]
push eax
lea eax, [ebp + 0x13ac]
push str._s_d_s_s_d_s_d_d_s
push eax
call fcn.10045378
add esp, 0x2c
lea eax, [ebp + 0x13ac]
push eax
lea eax, [ebp + 0x5938]
push eax
lea eax, [ebp + 0x5738]
push eax
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.100422d1
mov eax, dword [0x1015668c]
add esp, 0x10
cmp eax, 0x88
je 0x1003a12e
cmp eax, 0x44
jne 0x1003a152
lea eax, [ebp + 0x13ac]
push eax
lea eax, [ebp + 0x5938]
push eax
lea eax, [ebp + 0x5738]
push eax
push str.SendInfoDisplayRansom_disp_sKey_:__s_sVal_:__s_sData_:__s
push 0
call fcn.100412e2
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.tc_Last
push str.SOFTWARETrojanCut_tc_Env
push esi
call fcn.10041a19
mov eax, dword [0x1015668c]
add esp, 0x10
cmp eax, 0x11
je 0x1003a17b
cmp eax, 0x44
jne 0x1003a191
lea eax, [ebp + 0x13ac]
push eax
push str.SendInfoDisplayRansom__s_
push 0
call fcn.100412e2
add esp, 0xc
lea eax, [ebp + 0x6338]
push eax
push dword [ebp - 0x6c]
call fcn.10037fe5
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
pop ecx
pop ecx
mov edi, 0x100610e0
push edi
xor ebx, ebx
push ebx
call esi
cmp eax, ebx
jne 0x1003a1db
push edi
push ebx
call esi
cmp eax, ebx
jne 0x1003a1db
push ebx
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.WS2_32.dll_bind
call fcn.10040ccf
add esp, 0x10
cmp eax, ebx
je 0x1003a1fa
push dword [ebp - 0x5c]
push dword [ebp - 0x74]
push 0xc98
push eax
cmp dword [ebp - 0x60], ebx
je 0x1003a1f4
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1003a1fa
call dword [sym.imp.USER32.dll_PostMessageA]
mov esi, 0x88
cmp dword [0x1015668c], esi
jne 0x1003a21b
push dword [ebp - 0x5c]
push dword [ebp - 0x74]
push str.SendInfoDisplayRansom_disp_WPARAM_:__d_LPARAM_:__d
push ebx
call fcn.100412e2
add esp, 0x10
cmp dword [0x1015668c], 0x11
mov byte [0x102b5a44], 0
jne 0x1003a23c
push dword [ebp - 0x60]
push str.SendInfoDisplayRansom_flag__SEND_CUT__d_
push ebx
call fcn.100412e2
add esp, 0xc
mov eax, dword [0x1015668c]
cmp eax, esi
je 0x1003a24a
cmp eax, 0x44
jne 0x1003a257
push str.SendInfoDisplayRansom_End
push ebx
call fcn.100412e2
pop ecx
pop ecx
cmp dword [ebp - 0x60], ebx
je 0x1003a280
test byte [ebp + 0x694c], 4
je 0x1003a280
cmp dword [ebp + 0x6950], 0x80000000
jne 0x1003a280
mov dword [0x10151cbc], 0x63
call fcn.1002ca33
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp + 0x6940]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x6944
leave
ret 0x1c